Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
Memory corruption while operating the mailbox in Automotive.
Memory Corruption in WLAN HOST while fetching TX status information.
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.
Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
Memory corruption while invoking HGSL IOCTL context create.
Memory corruption in TZ Secure OS while loading an app ELF.
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Transient DOS while parse fils IE with length equal to 1.
Transient DOS in WLAN Firmware while parsing rsn ies.
Memory corruption while processing MBSSID beacon containing several subelement IE.
Memory corruption in Hypervisor when platform information mentioned is not aligned.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Transient DOS in Data modem while handling TLB control messages from the Network.