Buffer Over-read in WLAN Host

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.

Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

Integer Overflow or Wraparound in Graphics

Memory corruption while using alignments for memory allocation.

Missing Cryptographic Step in Data Modem

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

Use After Free in DSP Service

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.

Improper Validation of Array Index in Camera

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline.

Improper Validation of Array Index in Audio

Memory corruption may occur while validating ports and channels in Audio driver.

Use After Free in Automotive Android OS

Memory corruption may occur while accessing a variable during extended back to back tests.

NULL Pointer Dereference in Display

Memory corruption in display driver while detaching a device.

Use After Free in DSP Service

Memory corruption during concurrent SSR execution due to race condition on the global maps list.

Use After Free in HLOS

Memory corruption during concurrent access to server info object due to incorrect reference count update.

Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver

Memory corruption when blob structure is modified by user-space after kernel verification.

Use After Free in Camera Driver

Memory corruption during concurrent buffer access due to modification of the reference count.

Use After Free in Camera Driver

Memory corruption while encoding JPEG format.

Buffer Over-read in Camera Driver

Memory corruption due to improper bounds check while command handling in camera-kernel driver.

Improper Validation of Array Index in Camera Driver

Memory corruption during array access in Camera kernel due to invalid index from invalid command data.

Integer Overflow or Wraparound in Camera Driver

Memory corruption Camera kernel when large number of devices are attached through userspace.

Improper Validation of Array Index in Camera Driver

Memory corruption while prociesing command buffer buffer in OPE module.

Improper Input Validation in Camera Driver

Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information.