Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
Memory corruption while parsing qcp clip with invalid chunk data size.
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
Memory corruption while processing event close when client process terminates abruptly.
Memory corruption while parsing the ADSP response command.
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
Memory corruption while processing concurrent IOCTL calls.
Memory corruption while processing data packets in diag received from Unix clients.
Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.
Memory corruption during concurrent access to server info object due to unprotected critical field.
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
Memory corruption while verifying the serialized header when the key pairs are generated.
Transient DOS while parse fils IE with length equal to 1.
Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.
Transient DOS in Multi-Mode Call Processor while processing UE policy container.
Memory corruption while invoking HGSL IOCTL context create.
Memory corruption in HLOS while checking for the storage type.