Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
Memory corruption while processing Codec2 during v13k decoder pitch synthesis.
Memory corruption while processing TPC target power table in FTM TPC.
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.
information disclosure while invoking the mailbox read API.
Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
Memory corruption while Configuring the SMR/S2CR register in Bypass mode.
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.