Improper Validation of Array Index in Audio

Memory corruption may occur while validating ports and channels in Audio driver.

Use After Free in HLOS

Memory corruption during concurrent access to server info object due to incorrect reference count update.

Out-of-bounds Write in Audio

Memory corruption while sound model registration for voice activation with audio kernel driver.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Memory corruption while processing an IOCTL call to set mixer controls.

Use After Free in GPS HLOS Driver

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

Buffer Over-read in WLAN Host

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Incorrect Calculation of Buffer Size in HLOS

Memory corruption during PlayReady APP usecase while processing TA commands.

Out-of-bounds Write in Audio

Memory corruption while processing MFC channel configuration during music playback.

Buffer Over-read in Video

Transient DOS while parsing video packets received from the video firmware.

Buffer Over-read in Video

Information disclosure while processing a firmware event.

Use After Free in HLOS

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Incorrect Authorization in Boot

Memory corruption while loading an invalid firmware in boot loader.

Use of Out-of-range Pointer Offset in Multi-mode Call Processor

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the VOC packet data from ADSP.

Buffer Over-read in Video

Transient DOS while processing video packets received from video firmware.

Buffer Over-read in Core Services

Information disclosure while registering commands from clients with diag through diagHal.

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Use After Free in Data Network Stack & Connectivity

Memory corruption while processing IOCTL calls to add route entry in the HW.

Out-of-bounds Write in Audio

Memory corruption while accessing MSM channel map and mixer functions.