Out-of-bounds Write in HLOS

Memory corruption while processing a secure logging command in the trusted application.

Buffer Copy Without Checking Size of Input in Core Services

Memory corruption while copying packets received from unix clients.

Double Free in Video

Memory Corruption when multiple threads concurrently access and modify shared resources.

Information Exposure in Computer Vision

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.

Untrusted Pointer Dereference in Camera

Memory corruption while preprocessing IOCTLs in sensors.

Buffer Copy without Checking Size of Input in DSP Service

Memory corruption while passing pages to DSP with an unaligned starting address.

Improper Validation of Array Index in Automotive Linux OS

Memory corruption when accessing resources in kernel driver.

Buffer Copy Without Checking Size of Input in DSP Service

Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.

Buffer Over-read in WLAN Firmware

Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.

Double Free in Graphics

Memory corruption occurs when a secure application is launched on a device with insufficient memory.

Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code Execution.

Untrusted Pointer Dereference in Video

Memory corruption while processing a video session to set video parameters.

Untrusted Pointer Dereference in TZ Firmware

Information disclosure while processing system calls with invalid parameters.

Use After Free in DSP Service

Memory corruption while handling concurrent memory mapping and unmapping requests from a user-space application.

Buffer Copy Without Checking Size of Input in Boot

Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.

Use of Out-of-range Pointer Offset in Multi-mode Call Processor

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio

Memory corruption while copying the sound model data from user to kernel buffer during sound model register.

Time-of-check Time-of-use (TOCTOU) Race Condition in Hypervisor

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.

Use After Free in Audio

Memory corruption in Audio when SSR event is triggered after music playback is stopped.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the VOC packet data from ADSP.