Search vulnerabilities
Incorrect Calculation of Buffer Size in HLOS
Memory corruption during PlayReady APP usecase while processing TA commands.
Out-of-bounds Write in Display
Memory corruption while processing a malformed license file during reboot.
Use After Free in Secure Processor
Memory Corruption when multiple threads simultaneously access a memory free API.
Use After Free in Audio
Memory Corruption in Audio while invoking IOCTLs calls from the user-space.
Buffer Copy Without Checking Size of Input in SPS Applications
Memory Corruption in SPS Application while exporting public key in sorter TA.
Integer Overflow to Buffer Overflow in TZ Secure OS
Memory corruption while loading an ELF segment in TEE Kernel.
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Radio Interface Layer
Memory corruption while sending SMS from AP firmware.
Buffer Over-read in Data HLOS - LNX
Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
Untrusted Pointer Dereference in Camera
Memory Corruption when processing IOCTLs for JPEG data without verification.
Use of Out-of-range Pointer Offset in Multi-mode Call Processor
Memory Corruption in Multi-mode Call Processor while processing bit mask API.
Time-of-check Time-of-use (TOCTOU) Race Condition in Hypervisor
Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing the VOC packet data from ADSP.
Buffer Copy Without Checking Size of Input in Audio
Memory Corruption in Audio while invoking callback function in driver from ADSP.
Buffer Copy Without Checking Size of Input in Automotive Audio
Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.
Improper Input Validation in Secure Processor
Memory corruption when the channel ID passed by user is not validated and further used.
Improper Access Control in Core
Memory corruption may occur while attaching VM when the HLOS retains access to VM.
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
Out-of-bounds Read in Core
Information disclosure while processing the hash segment in an MBN file.