Improper Authentication in Modem

While processing the authentication message in UE, improper authentication may lead to information disclosure.

Improper Authorization in SPS-HLOS

Information disclosure while deriving keys for a session for any Widevine use case.

Buffer Over-read in Hypervisor

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Buffer Over-read in Data Modem

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Use of Out-of-range Pointer Offset in Modem

Memory corruption in Modem while processing security related configuration before AS Security Exchange.

Buffer Over-read in Data Modem

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.

Buffer Copy Without Checking Size of Input in WLAN HOST

Memory Corruption in WLAN HOST while parsing QMI response message from firmware.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Memory corruption while playing audio file having large-sized input buffer.

Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS

Memory corruption in TZ Secure OS while loading an app ELF.

Improper Authentication in Multi-Mode Call Processor

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

Buffer Over-read in WLAN Host Cmn

Memory corruption during management frame processing due to mismatch in T2LM info element.

Use of Out-of-range Pointer Offset in Computer Vision

Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Camera_Linux

Memory corruption while processing camera TPG write request.

Use After Free in DSP Service

Memory corruption during sub-system restart while processing clean-up to free up resources.

Use After Free in Camera Linux

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.

Use After Free in Automotive Multimedia

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Cryptographic Issues in Automotive

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile