Snapdragon 8\+ Gen 1 Firmware
by Qualcomm
CVEs (23)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-28581 | Cri | 0.64 | 9.8 | 0.00 | Sep 5, 2023 | Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE. | ||
| CVE-2023-22667 | Hig | 0.55 | 8.4 | 0.00 | Jul 4, 2023 | Memory Corruption in Audio while allocating the ion buffer during the music playback. | ||
| CVE-2025-47348 | Hig | 0.51 | 7.8 | 0.00 | Jan 7, 2026 | Memory corruption while processing identity credential operations in the trusted application. | ||
| CVE-2025-21424 | Hig | 0.51 | 7.8 | 0.00 | Mar 3, 2025 | Memory corruption while calling the NPU driver APIs concurrently. | ||
| CVE-2024-53024 | Hig | 0.51 | 7.8 | 0.00 | Mar 3, 2025 | Memory corruption in display driver while detaching a device. | ||
| CVE-2024-43062 | Hig | 0.51 | 7.8 | 0.00 | Mar 3, 2025 | Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization. | ||
| CVE-2024-43055 | Hig | 0.51 | 7.8 | 0.00 | Mar 3, 2025 | Memory corruption while processing camera use case IOCTL call. | ||
| CVE-2023-28542 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2023 | Memory Corruption in WLAN HOST while fetching TX status information. | ||
| CVE-2023-28541 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2023 | Memory Corruption in Data Modem while processing DMA buffer release event about CFR data. | ||
| CVE-2023-24854 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2023 | Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message. | ||
| CVE-2023-24851 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2023 | Memory Corruption in WLAN HOST while parsing QMI response message from firmware. | ||
| CVE-2023-22386 | Hig | 0.51 | 7.8 | 0.00 | Jul 4, 2023 | Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory. | ||
| CVE-2024-33051 | Hig | 0.49 | 7.5 | 0.00 | Sep 2, 2024 | Transient DOS while processing TIM IE from beacon frame as there is no check for IE length. | ||
| CVE-2024-33050 | Hig | 0.49 | 7.5 | 0.00 | Sep 2, 2024 | Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper. | ||
| CVE-2023-33016 | Hig | 0.49 | 7.5 | 0.00 | Sep 5, 2023 | Transient DOS in WLAN firmware while parsing MLO (multi-link operation). | ||
| CVE-2023-28584 | Hig | 0.49 | 7.5 | 0.00 | Sep 5, 2023 | Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA). | ||
| CVE-2023-21631 | Hig | 0.49 | 7.5 | 0.00 | Jul 4, 2023 | Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network. | ||
| CVE-2023-28577 | Med | 0.44 | 6.7 | 0.00 | Aug 8, 2023 | In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel… | ||
| CVE-2023-28575 | Med | 0.44 | 6.7 | 0.00 | Aug 8, 2023 | The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it. | ||
| CVE-2023-21640 | Med | 0.44 | 6.7 | 0.00 | Jul 4, 2023 | Memory corruption in Linux when the file upload API is called with parameters having large buffer. |
- risk 0.64cvss 9.8epss 0.00
Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.
- risk 0.55cvss 8.4epss 0.00
Memory Corruption in Audio while allocating the ion buffer during the music playback.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing identity credential operations in the trusted application.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while calling the NPU driver APIs concurrently.
- risk 0.51cvss 7.8epss 0.00
Memory corruption in display driver while detaching a device.
- risk 0.51cvss 7.8epss 0.00
Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.
- risk 0.51cvss 7.8epss 0.00
Memory corruption while processing camera use case IOCTL call.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption in WLAN HOST while fetching TX status information.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
- risk 0.51cvss 7.8epss 0.00
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
- risk 0.49cvss 7.5epss 0.00
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
- risk 0.49cvss 7.5epss 0.00
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
- risk 0.49cvss 7.5epss 0.00
Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA).
- risk 0.49cvss 7.5epss 0.00
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
- risk 0.44cvss 6.7epss 0.00
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel…
- risk 0.44cvss 6.7epss 0.00
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
- risk 0.44cvss 6.7epss 0.00
Memory corruption in Linux when the file upload API is called with parameters having large buffer.
Page 1 of 2