Use After Free in Automotive GPU
Memory Corruption when copying data from a freed source while executing performance counter deselect operation.
Memory Corruption when copying data from a freed source while executing performance counter deselect operation.
Transient DOS when processing target power rate tables during channel configuration.
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
Memory corruption while processing IOCTL command when device is in power-save state.
Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.
Memory corruption may occur while validating ports and channels in Audio driver.
Memory corruption in display driver while detaching a device.
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
Memory corruption while triggering commands in the PlayReady Trusted application.
Memory corruption during the FRS UDS generation process.
Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.
Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors.