Search vulnerabilities
Improper Access Control in Kernel
Improper Access to the VM resource manager can lead to Memory Corruption.
Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while allocating the ion buffer during the music playback.
Buffer Copy without Checking Size of Input in Audio
Memory corruption while processing audio effects.
Use After Free in Audio
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Improper Input Validation in Services
Memory corruption in Core Services while executing the command for removing a single event listener.
Integer Overflow or Wraparound in Core Services
Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.
Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS
Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
Double Free in Modem
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
Return of Stack Variable Address in Buses
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Buffer Copy Without Checking Size of Input in SPS Applications
Memory corruption in SPS Application while requesting for public key in sorter TA.
Buffer Over-read in WLAN Host
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
Use After Free in Kernel
Memory corruption when there is failed unmap operation in GPU.
Improper Authentication in Core
Memory Corruption in Core due to secure memory access by user while loading modem image.
Use of Out-of-range Pointer Offset in Video
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Buffer copy without checking size of Input in Core
Memory corruption in Core while processing control functions.
Use After Free in HLOS
Memory corruption during concurrent access to server info object due to unprotected critical field.
Use After Free in DSP Service
Memory corruption when two threads try to map and unmap a single node simultaneously.