Search vulnerabilities
Use After Free in DSP Service
Memory corruption when two threads try to map and unmap a single node simultaneously.
Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while allocating the ion buffer during the music playback.
Buffer Copy Without Checking Size of Input in SPS Applications
Memory corruption in SPS Application while requesting for public key in sorter TA.
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when user provides data for FM HCI command control operations.
NULL Pointer Dereference in SPS-HLOS
Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.
Double Free in Modem
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
Improper Authentication in Core
Memory Corruption in Core due to secure memory access by user while loading modem image.
Integer Overflow to Buffer Overflow in User Identity Module
Memory corruption while using the UIM diag command to get the operators name.
Improper Input Validation in Services
Memory corruption in Core Services while executing the command for removing a single event listener.
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing a BTM request.
Buffer Copy Without Checking Size of Input in Boot
Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
Buffer over-read in WLAN Firmware
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
Buffer Copy Without Checking Size of Input in WLAN HOST
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while running invalid audio recording from ADSP.
Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
Buffer copy without checking size of Input in Core
Memory corruption in Core while processing control functions.
Improper Authentication in Modem
While processing the authentication message in UE, improper authentication may lead to information disclosure.
Out-of-bounds Write in Video
Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware.
Use After Free in Kernel
Memory corruption when there is failed unmap operation in GPU.