Buffer Over-read in Trusted Execution Environment
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.
Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Transient DOS while processing received beacon frame.
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
Transient DOS while parsing per STA profile in ML IE.
Memory corruption while invoking HGSL IOCTL context create.
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.