Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Information Exposure in TZ Secure OS

There may be information disclosure during memory re-allocation in TZ Secure OS.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

Improper Input Validation in Trusted Execution Environment

Cryptographic issue while parsing RSA keys in COBR format.

Buffer Copy Without Checking Size of Input in SPS Applications

Memory corruption in SPS Application while requesting for public key in sorter TA.

Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS

Memory corruption in TZ Secure OS while loading an app ELF.

Improper Authorization in HLOS

Cryptographic issue in HLOS during key management.

Double Free in Modem

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.

NULL Pointer Dereference in WLAN Firmware

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

Buffer Over-read in WLAN Firmware

Transient DOS while parse fils IE with length equal to 1.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

Buffer over-read in WLAN Firmware

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

NULL pointer dereference in WLAN Firmware

Memory corruption when processing cmd parameters while parsing vdev.

Buffer copy without checking size of Input in Core

Memory corruption in Core while processing control functions.

Buffer Over-read in WLAN HAL

Information disclosure in WLAN HAL while handling the WMI state info command.

Buffer Copy Without Checking Size of Input in Boot

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

Improper Authorization in SPS-HLOS

Information disclosure while deriving keys for a session for any Widevine use case.

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.