NULL Pointer Dereference in WLAN Firmware

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

Buffer Copy Without Checking Size of Input in Hypervisor

Memory corruption in Hypervisor when platform information mentioned is not aligned.

Incorrect Type Conversion or Cast in Multi-Mode Call Processor

Transient DOS while processing DL NAS TRANSPORT message with payload length 0.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the calibration data returned from ACDB loader.

Improper Input Validation in Multi-Mode Call Processor

Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.

Buffer Over-read in WLAN Firmware

Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.

NULL Pointer Dereference in WLAN Firmware

Transient DOS when processing a NULL buffer while parsing WLAN vdev.

Buffer Copy without Checking Size of Input in WLAN Firmware

Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.

NULL Pointer Dereference in WLAN Firmware

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

Improper Release of Memory Before Removing Last Reference in Multi-Mode Call Processor

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.

Improper Authorization in HLOS

Cryptographic issue in HLOS during key management.

Reachable Assertion in WLAN Firmware

Transient DOS while processing 11AZ RTT management action frame received through OTA.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Buffer Over-read in Data Modem

Transient DOS in Data Modem during DTLS handshake.

Use of Out-of-range Pointer Offset in Audio

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio during playback with speaker protection.

Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables