Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while allocating the ion buffer during the music playback.
Memory Corruption in Audio while allocating the ion buffer during the music playback.
Memory corruption in Core while processing control functions.
Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Memory corruption while processing IOCTL call for getting group info.
Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption while processing manipulated payload in video firmware.
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Memory Corruption in Core due to secure memory access by user while loading modem image.
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
Memory corruption when there is failed unmap operation in GPU.