Improper Validation of Array Index in HLOS

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.

Use After Free in HLOS

Memory corruption when multiple listeners are being registered with the same file descriptor.

NULL Pointer Dereference in SPS-HLOS

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

Use After Free in Qualcomm IPC

Memory corruption while processing concurrent IOCTL calls.

Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

Buffer Over-read in Audio

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

Buffer Over-read in Audio

Information disclosure in Audio while accessing AVCS services from ADSP payload.

Use of Out-of-range Pointer Offset in Audio

Memory corruption in Audio while processing RT proxy port register driver.

Use After Free in Audio

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.

Untrusted Pointer Dereference in Video

Memory corruption in video while parsing invalid mp2 clip.

Buffer Over-read in Video

Information disclosure while parsing dts header atom in Video.

Buffer Copy Without Checking Size of Input in WLAN Host

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.

Use of Out-of-range Pointer Offset in PCIe

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.

Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-Applications

Memory corruption while processing finish_sign command to pass a rsp buffer.

Use After Free in Camera Linux

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.

Use After Free in Automotive Multimedia

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Double Free in Data Network Stack & Connectivity

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.

Buffer Copy without Checking Size of Input in HLOS

Memory corruption in HLOS while running playready use-case.

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables