Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption when user provides data for FM HCI command control operations.
Transient DOS in Bluetooth Host while rfc slot allocation.
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
Memory corruption in HLOS while running playready use-case.
Memory corruption in Audio during playback with speaker protection.
Memory corruption while processing API calls to NPU with invalid input.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
Memory corruption while processing GPU page table switch.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption while handling session errors from firmware.