Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Information Exposure in TZ Secure OS

There may be information disclosure during memory re-allocation in TZ Secure OS.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage

memory corruption when an invalid firehose patch command is invoked.

Improper Input Validation in Trusted Execution Environment

Cryptographic issue while parsing RSA keys in COBR format.

Double Free in Modem

Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.

NULL pointer dereference in WLAN Firmware

Memory corruption when processing cmd parameters while parsing vdev.

Improper Input Validation in Services

Memory corruption in Core Services while executing the command for removing a single event listener.

Buffer Copy Without Checking Size of Input in Boot

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

Buffer Over-read in WLAN Firmware

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing rsn ies.

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while processing RT proxy port register driver.

Improper Authorization in SPS-HLOS

Information disclosure while deriving keys for a session for any Widevine use case.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing a BTM request.

NULL Pointer Dereference in WLAN Firmware

Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.

NULL pointer Dereference in Modem

Transient DOS in Modem while allocating DSM items.

Buffer Over-read in WLAN HAL

Information disclosure in WLAN HAL while handling command through WMI interfaces.

Buffer Over-read in IOE Firmware

Information disclosure in IOE Firmware while handling WMI command.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.