Search vulnerabilities
Use After Free in HLOS
Memory corruption while handling buffer mapping operations in the cryptographic driver.
Use of Uninitialized Variable in HLOS
Memory corruption while processing identity credential operations in the trusted application.
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Memory corruption while processing a config call from userspace.
Buffer Copy Without Checking Size of Input in Camera Driver
Memory corruption while processing shared command buffer packet between camera userspace and kernel.
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver
Memory corruption while handling sensor utility operations.
Buffer Copy Without Checking Size of Input in Core Services
Memory corruption while copying packets received from unix clients.
Information Exposure in Computer Vision
Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.
Time-of-check Time-of-use (TOCTOU) Race Condition in Hypervisor
Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.
Improper Access Control in Graphics Linux
Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.
Use After Free in Computer Vision
Memory corruption while processing IOCTL command to handle buffers associated with a session.
Improper Access Control in Core
Memory corruption may occur while attaching VM when the HLOS retains access to VM.
Out-of-bounds Read in Core
Information disclosure while processing the hash segment in an MBN file.
Out-of-bounds Read in Core
Information disclosure while reading data from an image using specified offset and size parameters.
Buffer Over-read in WLAN Host Communication
Transient DOS while processing the EHT operation IE in the received beacon frame.
Buffer Over-read in BT Controller
Transient DOS while parsing the EPTM test control message to get the test pattern.
Buffer Over-read in Video
Transient DOS while processing video packets received from video firmware.
Buffer Over-read in Core Services
Information disclosure while registering commands from clients with diag through diagHal.
Reachable Assertion in BT Controller
Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.