Untrusted Pointer Dereference in Core

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request.

Integer overflow or wraparound in WLAN

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Incorrect type conversion in WLAN

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.

Integer overflow to buffer overflow in WLAN

Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.

Improper access control in Kernel

Memory corruption due to improper access control in kernel while processing a mapping request from root process.

Information exposure in Kernel

Information disclosure in Kernel due to indirect branch misprediction.

Buffer copy without checking size of input in WLAN Firmware

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.

Buffer over-read in WLAN Firmware.

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

Buffer copy without checking size of input in Audio.

Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.

Buffer over-read in Bluetooth Host.

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.

Buffer copy without checking the size of input in Core

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.

Access of uninitialized pointer in Bluetooth HOST

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.

Stack based buffer overflow in WLAN

Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length.

Buffer copy without checking size of input in modem

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.

Buffer over-read in WLAN

Information disclosure due to buffer over-read in WLAN while parsing NMF frame.

Time-of-check time-of-use race condition in Core

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.

Improper authentication in Qualcomm IPC

Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.

Buffer copy without checking size of input in Hypervisor

Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory.

Double free in Core

Memory corruption due to double free in core while initializing the encryption key.

Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music