Use After Free in NPU

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Improper Validation of Array Index in Audio

Memory corruption may occur while validating ports and channels in Audio driver.

NULL Pointer Dereference in Display

Memory corruption in display driver while detaching a device.

Use After Free in NPU

Memory corruption while calling the NPU driver APIs concurrently.

Use After Free in HLOS

Memory corruption during concurrent access to server info object due to incorrect reference count update.

Use After Free in GPS HLOS Driver

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

Out-of-bounds Write in Computer Vision

Memory corruption while reading the FW response from the shared queue.

Out-of-bounds Write in Computer Vision

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Buffer Over-read in WLAN Host

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Buffer Copy Without Checking Size of Input in HLOS

Memory corruption while performing private key encryption in trusted application.

Improper Restriction of Operations within the Bounds of a Memory Buffer in Data Network Stack & Connectivity

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

Incorrect Calculation of Buffer Size in HLOS

Memory corruption during PlayReady APP usecase while processing TA commands.

Buffer Copy Without Checking Size of Input in SPS Applications

Memory Corruption in SPS Application while exporting public key in sorter TA.

Integer Overflow to Buffer Overflow in TZ Secure OS

Memory corruption while loading an ELF segment in TEE Kernel.

Buffer Over-read in Data HLOS - LNX

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

Out-of-bounds Write in Audio

Memory corruption while processing MFC channel configuration during music playback.

Buffer Over-read in Data Network Stack & Connectivity

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.

Use After Free in Video

Memory corruption during video playback when video session open fails with time out error.