Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

Buffer copy without checking size of Input in Core

Memory corruption in Core while processing control functions.

Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Buffer Copy Without Checking Size of Input in Audio

Memory corruption in Audio while processing the calibration data returned from ACDB loader.

Buffer Over-read in WLAN Host Communication

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

Buffer Over-read in Audio

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

Buffer Over-read in Video

Information disclosure in Video while parsing mp2 clip with invalid section length.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware while parsing rsn ies.

Buffer Over-read in WLAN HOST

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.

Buffer Copy Without Checking Size of Input in Trusted Execution Environment

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

Improper Authorization in HLOS

Cryptographic issue in HLOS during key management.

Buffer Over-read in Trusted Execution Environment

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

Buffer Over-read in WLAN Firmware

Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.

Use After Free in Automotive Multimedia

Memory corruption while invoking IOCTLs calls in Automotive Multimedia.

Configuration Issue in Core

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Integer Overflow or Wraparound in TZ Secure OS

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables