Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Use After Free in DSP Services

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Out-of-bounds Write in Audio

Memory corruption while accessing MSM channel map and mixer functions.

Use After Free in HLOS

Memory corruption while invoking IOCTL map buffer request from userspace.

Information Exposure in TZ Secure OS

There may be information disclosure during memory re-allocation in TZ Secure OS.

Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL

Information disclosure while creating MQ channels.

Buffer Over-read in WLAN Firmware

Transient DOS may occur while parsing SSID in action frames.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

Buffer Over-read in WLAN Firmware

Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).

Incorrect Calculation of Buffer Size in Video

Memory corruption while processing video packets received from video firmware.

Buffer Over-read in Audio

information disclosure while invoking calibration data from user space to update firmware size.

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption while processing I2C settings in Camera driver.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption may occur while processing voice call registration with user.

Buffer Copy Without Checking Size of Input in Powerline Communication Firmware

Memory corruption while processing specific files in Powerline Communication Firmware.

Integer Overflow to Buffer Overflow in HLOS

Memory corruption in HLOS while invoking IOCTL calls from user-space.

Improper Authorization in HLOS

Cryptographic issue in HLOS during key management.

Buffer Over-read in WLAN Firmware

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications

Memory corruption while processing finish_sign command to pass a rsp buffer.

Buffer Copy Without Checking Size of Input in Boot

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.