Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations.
Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption while running VK synchronization with KASAN enabled.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption while processing MBSSID beacon containing several subelement IE.
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Information disclosure while handling T2LM Action Frame in WLAN Host.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Information disclosure while handling SA query action frame.
INformation disclosure while handling Multi-link IE in beacon frame.
Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
Memory corruption due to improper access control in Qualcomm IPC.
Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
Transient DOS while parsing the received TID-to-link mapping action frame.
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
Information disclosure while handling beacon or probe response frame in STA.
Information disclosure while handling beacon probe frame during scan entry generation in client side.
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
Transient DOS while parsing ESP IE from beacon/probe response frame.
Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.