Qualcomm

Memory corruption while preprocessing IOCTLs in sensors.

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a ses

Memory Corruption when multiple threads concurrently access and modify shared resources.

Memory corruption while processing identity credential operations in the trusted application.

Memory corruption while processing a secure logging command in the trusted application.

Cryptographic issue may occur while encrypting license data.

Memory corruption while handling sensor utility operations.

Memory corruption while processing a video session to set video parameters.

Memory corruption while deinitializing a HDCP session.

Memory corruption while accessing a synchronization object during concurrent operations.

Memory corruption while performing sensor register read operations.

Memory corruption while parsing clock configuration data for a specific hardware type.

Memory corruption while processing shared command buffer packet between camera userspace and kernel.

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Memory corruption while processing a config call from userspace.

Information disclosure while processing a firmware event.

Transient DOS while parsing video packets received from the video firmware.

Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware. in Snapdragon A

Improper Access Control for RPU write access from secure processor in Snapdragon Auto, Snapdragon Compute, Snapdragon Co

Device memory may get corrupted because of buffer overflow/underflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon

Out of boundary access is possible as there is no validation of data accessed against the received size of the packet in

Out of bounds memcpy can occur by providing the embedded NULL character string and length greater than the actual string

Buffer overwrite can occur in IEEE80211 header filling function due to lack of range check of array index received from

Out of bound access can occur while processing firmware event due to lack of validation of WMI message received from fir

Use of local variable as argument to netlink CB callback goes out of it scope when callback triggered lead to invalid st

Out of bound access can occur while processing peer info in IBSS connection mode due to lack of upper bounds check to en

Possible buffer overwrite in message handler due to lack of validation of tid value calculated from packets received fro

Possibility of out of bound access in debug queue, if packet size field is corrupted in Snapdragon Auto, Snapdragon Comp

Improper check in video driver while processing data from video firmware can lead to integer overflow and then buffer ov

Possible OOB issue in EEPROM due to lack of check while accessing memory map array at the time of reading operation in S

Out-of-bound read in the wireless driver in the Linux kernel due to lack of check of buffer length. in Snapdragon Auto,

Improper length check on source buffer to handle userspace data received can lead to out-of-bound access in diag handler

Improper validation of event buffer extracted from FW response can lead to integer overflow, which will allow to pass th

Potential double free scenario if driver receives another DIAG_EVENT_LOG_SUPPORTED event from firmware as the pointer is

Buffer overflow during SIB read when network configures complete sib list along with first and last segment of other SIB

Use after free of a pointer in iWLAN scenario during netmgr state transition to CONNECT in Snapdragon Auto, Snapdragon C

Memory is being freed up twice when two concurrent threads are executing in parallel in Snapdragon Auto, Snapdragon Comp

Multiple read overflows in MM while decoding service accept,service reject,attach reject and MT detach in Snapdragon Aut

Possibility of Null pointer access if the SPDM commands are executed in the non-standard way in Trustzone in Snapdragon

While processing MT Secondary PDP request, Buffer overflow will happen due to incorrect calculation of buffer size in Sn

Buffer over read can happen while parsing SMS OTA messages at transport layer if network sends un-intended values in Sna

Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a p

Out of bound access occurs while handling the WMI FW event due to lack of check of buffer argument which comes directly

Out of bound write can happen in WMI firmware event handler due to lack of validation of data received from WLAN firmwar

When a fake broadcast/multicast 11w rmf without mmie received, since no proper length check in wma_process_bip, buffer o

Crafted image that has a valid signature from a non-QC entity can be loaded which can read/write memory that belongs to

While Skipping unknown IES, EMM is reading the buffer even if the no of bytes to read are more than message length which

Incorrect length used while validating the qsee log buffer sent from HLOS which could then lead to remap conflict in Sna

Possible out of bounds write in a MT SMS/SS scenario due to improper validation of array index in Snapdragon Auto, Snapd

HLOS could corrupt CPZ page table memory for S1 managed VMs in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv