Qualcomm

In wlan driver, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00348479; Issue ID: MSV-1019.

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: fix global oob in rmnet_policy The variable rmnet_link_ops assign a *bigger* maxtype which leads to a global out-of-bounds read when parsing the netlink attributes. See bug trace below: …

Memory corruption in HLOS while converting from authorization token to HIDL vector.

Memory corruption in Audio while processing IIR config data from AFE calibration block.

Information disclosure in Audio while accessing AVCS services from ADSP payload.

Transient DOS in Multi-Mode Call Processor while processing UE policy container.

Transient DOS in Multi-Mode Call Processor due to UE failure because of heap leakage.

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.

Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.

Transient DOS in WLAN Firmware while parsing a BTM request.

Memory corruption in HLOS while running playready use-case.

Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.

In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local information disclosure with no execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00325055; Issue ID: MSV-868.

Memory corruption in WLAN Host while processing RRM beacon on the AP.

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.

Transient DOS in Bluetooth Host while rfc slot allocation.

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.

Memory Corruption in SPS Application while exporting public key in sorter TA.

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.

Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.

Memory corruption in Audio while processing the VOC packet data from ADSP.

Memory Corruption in Audio while invoking callback function in driver from ADSP.

Information disclosure in WLAN HAL when reception status handler is called.

Information disclosure in WLAN HAL while handling the WMI state info command.

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.

Information Disclosure in WLAN Host when processing WMI event command.

Memory Corruption in Multi-mode Call Processor while processing bit mask API.

Memory corruption in Automotive Display while destroying the image handle created using connected display driver.

Memory corruption in DSP Service during a remote call from HLOS to DSP.

Transient DOS in WLAN Firmware while parsing rsn ies.

Transient DOS in WLAN Firmware while parsing a NAN management frame.

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.

Cryptographic issue in Data Modem due to improper authentication during TLS handshake.

Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.

A malformed DLC can trigger Memory Corruption in SNPE library due to out of bounds read, such as by loading an untrusted model (e.g. from a remote source).

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE.

Transient DOS in WLAN firmware while parsing MLO (multi-link operation).

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.

Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.

Memory corruption in WLAN HAL while parsing WMI command parameters.

Memory corruption in WLAN HAL while handling command streams through WMI interfaces.

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.

Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.

Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.