Buffer Over-read in WLAN Host
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
Transient DOS while parsing the received TID-to-link mapping action frame.
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
Memory corruption while processing GPU page table switch.
Memory corruption while processing voice packet with arbitrary data received from ADSP.
Memory corruption while redirecting log file to any file location with any file name.