Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
Memory Corruption in Multi-mode Call Processor while processing bit mask API.
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
Memory corruption in HLOS while running playready use-case.
Memory corruption in Core Services while executing the command for removing a single event listener.
Memory corruption due to double free in core while initializing the encryption key.
Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
Memory corruption while loading an ELF segment in TEE Kernel.
Memory corruption in Audio during playback with speaker protection.
Memory corruption while running NPU, when NETWORKUNLOAD and (NETWORKUNLOAD or NETWORKEXECUTEV2) commands are submitted at the same time.
Memory corruption in Audio while processing RT proxy port register driver.
Memory corruption in SPS Application while requesting for public key in sorter TA.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption while processing finishsign command to pass a rsp buffer.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Memory corruption in Graphics while importing a file.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Memory Corruption in Core due to secure memory access by user while loading modem image.
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.
Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption in Audio while processing the calibration data returned from ACDB loader.