Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
Memory corruption while processing Codec2 during v13k decoder pitch synthesis.
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
Memory corruption during session sign renewal request calls in HLOS.
Memory corruption when keymaster operation imports a shared key.
Possible out of bound access in audio module due to lack of validation of user provided input.
Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.