Search vulnerabilities
Use of Out-of-range Pointer Offset in Graphics
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
Integer Overflow or Wraparound in Graphics Linux
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Exposed Dangerous Method or Function in HLOS
Cryptographic issues while generating an asymmetric key pair for RKP use cases.
Information Exposure in TZ Secure OS
There may be information disclosure during memory re-allocation in TZ Secure OS.
Weak Authentication in HLOS
Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.
Buffer Over-read in WLAN Host
Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
Insufficient Granularity of Access Control in Core
Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.
Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage
memory corruption when an invalid firehose patch command is invoked.
Improper Input Validation in Trusted Execution Environment
Cryptographic issue while parsing RSA keys in COBR format.
Buffer Over-read in Multi Mode Call Processor
Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
Incorrect Calculation of Buffer Size in Video
Memory corruption while processing video packets received from video firmware.
Improper Input Validation in Modem
Transient DOS while processing CCCH data when NW sends data with invalid length.
Reachable Assertion in Modem
Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.
Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while allocating the ion buffer during the music playback.
Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL while handling the WMI state info command.
Incorrect Type Conversion or Cast in Multi-Mode Call Processor
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
Improper Input Validation in Multi-Mode Call Processor
Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
Buffer Over-read in WLAN Firmware
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.