Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Kernel
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption while processing manipulated payload in video firmware.
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Memory Corruption in Core due to secure memory access by user while loading modem image.
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption when the IOCTL call is interrupted by a signal.
Information disclosure while handling T2LM Action Frame in WLAN Host.
Transient DOS in WLAN Firmware while parsing a BTM request.