Search vulnerabilities
Buffer Copy Without Checking Size of Input in HLOS
Memory corruption while performing private key encryption in trusted application.
Incorrect Calculation of Buffer Size in HLOS
Memory corruption during PlayReady APP usecase while processing TA commands.
Out-of-bounds Write in Display
Memory corruption while processing a malformed license file during reboot.
Buffer Copy Without Checking Size of Input in SPS Applications
Memory Corruption in SPS Application while exporting public key in sorter TA.
Integer Overflow to Buffer Overflow in TZ Secure OS
Memory corruption while loading an ELF segment in TEE Kernel.
Buffer Over-read in WLAN Embedded SW
Transient DOS may occur while processing malformed length field in SSID IEs.
Use of Out-of-range Pointer Offset in Multi-mode Call Processor
Memory Corruption in Multi-mode Call Processor while processing bit mask API.
Out-of-bounds Read in Core
Information disclosure while processing the hash segment in an MBN file.
Out-of-bounds Read in Core
Information disclosure while reading data from an image using specified offset and size parameters.
Integer Overflow or Wraparound in Graphics Linux
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
Use After Free in DSP Services
Memory corruption in DSP Services during a remote call from HLOS to DSP.
Information Exposure in TZ Secure OS
There may be information disclosure during memory re-allocation in TZ Secure OS.
Weak Authentication in HLOS
Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.
Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage
memory corruption when an invalid firehose patch command is invoked.
Improper Input Validation in Trusted Execution Environment
Cryptographic issue while parsing RSA keys in COBR format.
Buffer Over-read in WLAN Host
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
NULL pointer dereference in WLAN Firmware
Memory corruption when processing cmd parameters while parsing vdev.