Improper Authentication in Core

Memory Corruption in Core due to secure memory access by user while loading modem image.

Buffer Over-read in WLAN Embedded SW

Transient DOS while processing received beacon frame.

Use After Free in Automotive Multimedia

Memory corruption while invoking IOCTLs calls in Automotive Multimedia.

Integer Overflow to Buffer Overflow in HLOS

Memory corruption in HLOS while invoking IOCTL calls from user-space.

Improper Authorization in SPS-HLOS

Information disclosure while deriving keys for a session for any Widevine use case.

Buffer Over-read in Hypervisor

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Buffer Over-read in Data Modem

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.

Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS

Memory corruption in TZ Secure OS while loading an app ELF.

Buffer Over-read in Data Modem

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Use of Out-of-range Pointer Offset in Modem

Memory corruption in Modem while processing security related configuration before AS Security Exchange.

Buffer copy without checking size of Input in Core

Memory corruption in Core while processing control functions.

Use After Free in Audio

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.

Use After Free in Audio

Memory corruption in Audio when memory map command is executed consecutively in ADSP.

Improper Authentication in Multi-Mode Call Processor

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Improper Access Control in Core

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.

Improper Input Validation in HLOS

Memory Corruption in HLOS while registering for key provisioning notify.

Improper Authentication in Data Modem

Cryptographic issue in Data Modem due to improper authentication during TLS handshake.