Search vulnerabilities
Improper Validation of Array Index in HLOS
Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing rsn ies.
Buffer Copy without Checking Size of Input in WLAN Firmware
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
Improper Validation of Array Index in Automotive Autonomy
Memory corruption while operating the mailbox in Automotive.
Improper Authentication in Multi-Mode Call Processor
Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
Buffer Over-read in Data Modem
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
Buffer Copy Without Checking Size of Input in WLAN Host
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
Integer Overflow or Wraparound in Bluetooth Host
Transient DOS in Bluetooth Host while rfc slot allocation.
Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications
Memory corruption while processing finish_sign command to pass a rsp buffer.
Buffer over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing a NAN management frame.
Buffer Copy Without Checking Size of Input in HLOS
Memory corruption in HLOS while converting from authorization token to HIDL vector.
NULL pointer dereference in WLAN Firmware
Memory corruption when processing cmd parameters while parsing vdev.
NULL Pointer Dereference in WLAN Firmware
Transient DOS when processing a NULL buffer while parsing WLAN vdev.
Improper Input Validation in Multi-Mode Call Processor
Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
Incorrect Type Conversion or Cast in Multi-Mode Call Processor
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
NULL Pointer Dereference in WLAN Firmware
Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
Buffer Over-read in Trusted Execution Environment
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
Untrusted Pointer Dereference in Video
Memory corruption in video while parsing invalid mp2 clip.