Use After Free in Automotive Audio
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
Memory corruption in video while parsing invalid mp2 clip.
Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.
Transient DOS while parse fils IE with length equal to 1.
Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.
Memory corruption while invoking HGSL IOCTL context create.
Memory corruption while invoking IOCTLs calls in Automotive Multimedia.
Memory corruption while parsing qcp clip with invalid chunk data size.
Memory corruption when there is failed unmap operation in GPU.
Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.
Memory corruption when the payload received from firmware is not as per the expected protocol size.
Memory corruption while playing audio file having large-sized input buffer.
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
Memory corruption when Alternative Frequency offset value is set to 255.
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.