Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
Memory corruption while processing a malformed license file during reboot.
Memory corruption during PlayReady APP usecase while processing TA commands.
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
Memory corruption in HLOS while running playready use-case.
Memory corruption in Audio during playback with speaker protection.
Memory corruption in Core while processing control functions.
Memory corruption in Audio while processing RT proxy port register driver.
Memory corruption in SPS Application while requesting for public key in sorter TA.
Memory corruption while copying a keyblobs material when the key materials size is not accurately checked.
Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.
Transient DOS while loading the TA ELF file.
Memory corruption while processing key blob passed by the user.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption when an invoke call and a TEE call are bound for the same trusted application.
Memory corruption due to configuration weakness in modem wile sending command to write protected files.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESMIEI.
Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
Cryptographic issue while parsing RSA keys in COBR format.
memory corruption when an invalid firehose patch command is invoked.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Information disclosure while processing the hash segment in an MBN file.
Information disclosure while reading data from an image using specified offset and size parameters.
Memory Corruption in Data Modem while making a MO call or MT VOLTE call.
Possible out of bound read in DRM due to improper buffer length check. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking
Possible buffer overflow in voice service due to lack of input validation of parameters in QMI Voice API in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
While waiting for a response to a callback or listener request, non-secure clients can change permissions to shared memory buffers used by HLOS Invoke Call to secure kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking