Information exposure in Kernel

Information disclosure in Kernel due to indirect branch misprediction.

Improper authorization in Modem

Transient DOS due to improper authorization in Modem

Reachable assertion in Modem

Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported.

Reachable assertion in Modem

Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.

Buffer over-read in Bluetooth Host.

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.

A use after free vulnerability in perf-mgr driver prior to SMR Oct-2022 Release 1 allows attacker to cause memory access fault.

Double free in Automotive

Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.

Improper validation of array index in User Identity Module

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.

Use after free in Modem

Memory corruption due to use after free in Modem while modem initialization.

Integer overflow to buffer overflow in Modem

Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.

Improper validation of array index in Modem

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.

Buffer copy without checking the size of input in Core

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.

Buffer over-read in Trusted Execution Environment

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation.

Integer overflow or wraparound in Core

Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.

Improper restriction of operations within the bounds of memory buffer in Linux

Memory corruption in Linux while sending DRM request.

Stack-based buffer overflow in Modem

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.

Reachable assertion in Modem

Transient DOS due to reachable assertion in Modem because of invalid network configuration.

Double free in Core

Memory corruption due to double free in core while initializing the encryption key.

Buffer copy without checking the size of input in FM Host

Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host

Double free in Linux-Android

Memory corruption in Linux android due to double free while calling unregister provider after register call.