Memory corruption when Alternative Frequency offset value is set to 255.
Memory corruption while calling the NPU driver APIs concurrently.
Transient DOS may occur while processing the country IE.
Memory corruption may occur while validating ports and channels in Audio driver.
Memory corruption in Graphics while processing user packets for command submission.
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Memory Corruption in WLAN HOST while fetching TX status information.
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
The camgetdevicepriv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
In the function call related to CAMREQMGRRELEASEBUF there is no check if the buffer is being used. So when a function called cammemgetcpubuf to get the kernel va to use, another thread can call CAMREQMGRRELEASEBUF to unmap the kernel va which cause UAF of the kernel address.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
Information disclosure while deriving keys for a session for any Widevine use case.
Memory corruption in WLAN HAL while handling command through WMI interfaces.
Memory corruption in WLAN HAL while parsing WMI command parameters.
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
Possible integer overflow due to improper length check while updating grace period and count record in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Memory Corruption in Audio while allocating the ion buffer during the music playback.
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
Improper verification of timeout-based authentication in identity credential can lead to invalid authorization in HLOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Possible access control violation while setting current permission for VMIDs due to improper permission masking in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Memory corruption while processing command in Glink linux.
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile
Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Memory corruption may occur during IO configuration processing when the IO port count is invalid.