Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Use After Free in DSP Services

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Out-of-bounds Write in Audio

Memory corruption while accessing MSM channel map and mixer functions.

Use After Free in HLOS

Memory corruption while invoking IOCTL map buffer request from userspace.

Information Exposure in TZ Secure OS

There may be information disclosure during memory re-allocation in TZ Secure OS.

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Information disclosure while creating MQ channels.

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

Buffer Over-read in WLAN Firmware

Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

Buffer Over-read in Audio

information disclosure while invoking calibration data from user space to update firmware size.

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption while processing I2C settings in Camera driver.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption may occur while processing voice call registration with user.

Buffer Copy Without Checking Size of Input in Powerline Communication Firmware

Memory corruption while processing specific files in Powerline Communication Firmware.

NULL Pointer Dereference in WLAN Firmware

Transient DOS when processing a NULL buffer while parsing WLAN vdev.

Use of Out-of-range Pointer Offset in Qualcomm IPC

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.

NULL Pointer Dereference in WLAN Firmware

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

NULL Pointer Dereference in WLAN Firmware

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing a BTM request.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.