Use After Free in Kernel
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption during concurrent access to server info object due to unprotected critical field.
Transient DOS may occur while processing the country IE.
Transient DOS while processing received beacon frame.
Memory corruption in HLOS while running playready use-case.
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
Memory corruption in Audio during playback with speaker protection.
Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system image.
Weak configuration in Automotive while VM is processing a listener request from TEE.
Memory corruption due to double free in Core while mapping HLOS address to the list.
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.
Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.
Memory corruption when allocating and accessing an entry in an SMEM partition.
Memory corruption while performing finish HMAC operation when context is freed by keymaster.
Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.
Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.