Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Use After Free in DSP Services

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Out-of-bounds Write in Audio

Memory corruption while accessing MSM channel map and mixer functions.

Use After Free in HLOS

Memory corruption while invoking IOCTL map buffer request from userspace.

Information Exposure in TZ Secure OS

There may be information disclosure during memory re-allocation in TZ Secure OS.

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Information disclosure while creating MQ channels.

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

Buffer Over-read in WLAN Firmware

Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

Buffer Over-read in Audio

information disclosure while invoking calibration data from user space to update firmware size.

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption while processing I2C settings in Camera driver.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption may occur while processing voice call registration with user.

Buffer Copy Without Checking Size of Input in Powerline Communication Firmware

Memory corruption while processing specific files in Powerline Communication Firmware.

Buffer Copy Without Checking Size of Input in Boot

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing rsn ies.

NULL pointer dereference in WLAN Firmware

Memory corruption when processing cmd parameters while parsing vdev.

NULL Pointer Dereference in WLAN Firmware

Transient DOS when processing a NULL buffer while parsing WLAN vdev.

Out-of-bounds Write in Video

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.