Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption while invoking HGSL IOCTL context create.
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
Memory corruption when two threads try to map and unmap a single node simultaneously.
Memory corruption while processing IOCTL call for getting group info.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Memory corruption while processing multiple IOCTL calls from HLOS to DSP.
Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.
Memory corruption while calling the NPU driver APIs concurrently.
Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
Memory corruption while processing video packets received from video firmware.
Memory corruption while processing manipulated payload in video firmware.
Memory corruption in DSP Service during a remote call from HLOS to DSP.
Memory corruption in Core while processing RX intent request.
Memory corruption while processing identity credential operations in the trusted application.
Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.
Memory corruption while processing a malformed license file during reboot.
Memory corruption during PlayReady APP usecase while processing TA commands.
Memory corruption while handling buffer mapping operations in the cryptographic driver.
Cryptographic issue may occur while encrypting license data.
Transient DOS while parsing video packets received from the video firmware.
Information disclosure while processing a firmware event.
Transient DOS when WLAN firmware receives "reassoc response" frame including RICDATA element.
Memory corruption in Core while processing control functions.