Search vulnerabilities
Use After Free in HLOS
Memory corruption during concurrent access to server info object due to unprotected critical field.
Improper Validation of Array Index in Automotive Autonomy
Memory corruption while operating the mailbox in Automotive.
Buffer Copy Without Checking Size of Input in WLAN Host
Transient DOS may occur while processing the country IE.
NULL Pointer Dereference in SPS-HLOS
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
Buffer Over-read in WLAN Firmware
Transient DOS may occur when processing vendor-specific information elements while parsing a WLAN frame for BTM requests.
Improper Authentication in GPS_GNSS
Cryptographic issue occurs due to use of insecure connection method while downloading.
Buffer Over-read in WLAN Embedded SW
Transient DOS while processing received beacon frame.
Buffer Copy Without Checking Size of Input in Video
Memory corruption while processing manipulated payload in video firmware.
Buffer Copy Without Checking Size of Input in Core Services
Memory corruption while processing data packets in diag received from Unix clients.
Out-of-bounds Write in Video
Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
Use After Free in Camera Linux
Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.
Use After Free in Automotive Multimedia
Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.
Reachable Assertion in WLAN Firmware
Transient DOS while processing 11AZ RTT management action frame received through OTA.
Configuration Issue in Core
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
Cryptographic Issues in Automotive
Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
Buffer Copy without Checking Size of Input in HLOS
Memory corruption in HLOS while running playready use-case.
Use of Out-of-range Pointer Offset in Audio
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio during playback with speaker protection.