Incorrect Calculation of Buffer Size in HLOS

Memory corruption during PlayReady APP usecase while processing TA commands.

Out-of-bounds Write in Audio

Memory corruption while processing MFC channel configuration during music playback.

Buffer Over-read in Video

Transient DOS while parsing video packets received from the video firmware.

Buffer Over-read in Video

Information disclosure while processing a firmware event.

Use After Free in HLOS

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Information Exposure in Computer Vision

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.

Use of Out-of-range Pointer Offset in Multi-mode Call Processor

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the VOC packet data from ADSP.

Buffer Copy Without Checking Size of Input in Automotive Audio

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.

Buffer Over-read in BT Controller

Transient DOS while parsing the EPTM test control message to get the test pattern.

Buffer Over-read in Core Services

Information disclosure while registering commands from clients with diag through diagHal.

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Buffer Over-read in WLAN Host

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption may occur while processing voice call registration with user.

Buffer Over-read in Data Modem

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Return of Stack Variable Address in Buses

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

Improper Authentication in Multi-Mode Call Processor

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.