Buffer Over-read in WLAN Host Cmn
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
Transient DOS in WLAN Firmware while parsing no-inherit IES.
Memory corruption during management frame processing due to mismatch in T2LM info element.
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
Memory corruption in Kernel while parsing metadata.
Memory corruption when processing cmd parameters while parsing vdev.
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Transient DOS in WLAN Firmware while parsing a BTM request.
Memory corruption in Core Services while executing the command for removing a single event listener.
Memory corruption while processing manipulated payload in video firmware.