Snapdragon 8\+ Gen 2 Mobile Firmware
by Qualcomm
CVEs (304)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-33036 | Hig | 0.46 | 7.1 | 0.00 | Jan 2, 2024 | Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call. | ||
| CVE-2023-28556 | Hig | 0.46 | 7.1 | 0.00 | Nov 7, 2023 | Cryptographic issue in HLOS during key management. | ||
| CVE-2025-47334 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while processing shared command buffer packet between camera userspace and kernel. | ||
| CVE-2025-47332 | Med | 0.44 | 6.7 | 0.00 | Jan 7, 2026 | Memory corruption while processing a config call from userspace. | ||
| CVE-2024-49829 | Med | 0.44 | 6.7 | 0.00 | May 6, 2025 | Memory corruption can occur during context user dumps due to inadequate checks on buffer length. | ||
| CVE-2024-49848 | Med | 0.44 | 6.7 | 0.00 | Apr 7, 2025 | Memory corruption while processing multiple IOCTL calls from HLOS to DSP. | ||
| CVE-2024-33059 | Med | 0.44 | 6.7 | 0.00 | Jan 6, 2025 | Memory corruption while processing frame command IOCTL calls. | ||
| CVE-2024-33055 | Med | 0.44 | 6.7 | 0.00 | Jan 6, 2025 | Memory corruption while invoking IOCTL calls to unmap the DMA buffers. | ||
| CVE-2024-33041 | Med | 0.44 | 6.7 | 0.00 | Jan 6, 2025 | Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls, | ||
| CVE-2024-33040 | Med | 0.44 | 6.7 | 0.00 | Dec 2, 2024 | Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access. | ||
| CVE-2024-33036 | Med | 0.44 | 6.7 | 0.00 | Dec 2, 2024 | Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access. | ||
| CVE-2024-33032 | Med | 0.44 | 6.7 | 0.00 | Nov 4, 2024 | Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it. | ||
| CVE-2024-33030 | Med | 0.44 | 6.7 | 0.00 | Nov 4, 2024 | Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size. | ||
| CVE-2024-23386 | Med | 0.44 | 6.7 | 0.00 | Nov 4, 2024 | memory corruption when WiFi display APIs are invoked with large random inputs. | ||
| CVE-2024-23379 | Med | 0.44 | 6.7 | 0.00 | Oct 7, 2024 | Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario. | ||
| CVE-2024-23376 | Med | 0.44 | 6.7 | 0.00 | Oct 7, 2024 | Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call. | ||
| CVE-2024-23374 | Med | 0.44 | 6.7 | 0.00 | Oct 7, 2024 | Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file. | ||
| CVE-2024-33016 | Med | 0.44 | 6.8 | 0.00 | Sep 2, 2024 | memory corruption when an invalid firehose patch command is invoked. | ||
| CVE-2023-43527 | Med | 0.44 | 6.8 | 0.00 | May 6, 2024 | Information disclosure while parsing dts header atom in Video. | ||
| CVE-2023-43521 | Med | 0.44 | 6.7 | 0.00 | May 6, 2024 | Memory corruption when multiple listeners are being registered with the same file descriptor. |
- risk 0.46cvss 7.1epss 0.00
Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.
- risk 0.46cvss 7.1epss 0.00
Cryptographic issue in HLOS during key management.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while processing shared command buffer packet between camera userspace and kernel.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while processing a config call from userspace.
- risk 0.44cvss 6.7epss 0.00
Memory corruption can occur during context user dumps due to inadequate checks on buffer length.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while processing multiple IOCTL calls from HLOS to DSP.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while processing frame command IOCTL calls.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
- risk 0.44cvss 6.7epss 0.00
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
- risk 0.44cvss 6.7epss 0.00
Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
- risk 0.44cvss 6.7epss 0.00
Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size.
- risk 0.44cvss 6.7epss 0.00
memory corruption when WiFi display APIs are invoked with large random inputs.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
- risk 0.44cvss 6.7epss 0.00
Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.
- risk 0.44cvss 6.7epss 0.00
Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
- risk 0.44cvss 6.8epss 0.00
memory corruption when an invalid firehose patch command is invoked.
- risk 0.44cvss 6.8epss 0.00
Information disclosure while parsing dts header atom in Video.
- risk 0.44cvss 6.7epss 0.00
Memory corruption when multiple listeners are being registered with the same file descriptor.
Page 13 of 16