An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4nat'
Information disclosure possible while audio playback.
Information disclosure due to uninitialized variable.
Buffer overwrite in the WLAN host driver by leveraging a compromised WLAN FW
On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.
Certain unprivileged processes are able to perform IOCTL calls.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption while processing GPU page table switch.
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Transient DOS during music playback of ALAC content.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESMIEI.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption while handling user packets during VBO bind operation.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Memory corruption in Audio during playback with speaker protection.
Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
Information disclosure in WLAN HAL when reception status handler is called.
Memory corruption in core services when Diag handler receives a command to configure event listeners.
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
Memory corruption in WLAN handler while processing PhyID in Tx status handler.
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
Memory corruption in Graphics while processing user packets for command submission.
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.