Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Memory corruption when keymaster operation imports a shared key.
Possible out of bound access in audio module due to lack of validation of user provided input.
Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
Memory corruption while handling user packets during VBO bind operation.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
Memory corruption while processing key blob passed by the user.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
Information disclosure in Modem while processing SIB5.
Memory corruption while receiving a message in Bus Socket Transport Server.
Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.
Memory corruption in Graphics while processing user packets for command submission.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).