Qualcomm

Memory corruption while processing packet data with exceedingly large packet.

Memory corruption during sub-system restart while processing clean-up to free up resources.

Memory corruption during the image encoding process.

Memory corruption while processing data packets in diag received from Unix clients.

Memory corruption while processing command message in WLAN Host.

Memory corruption while processing event close when client process terminates abruptly.

Memory corruption while processing the TESTPATTERNCONFIG escape path.

Memory corruption while processing multiple simultaneous escape calls.

Memory corruption while executing timestamp video decode command with large input values.

Memory corruption while processing manipulated payload in video firmware.

Memory corruption while processing video packets received from video firmware.

Memory corruption while processing a private escape command in an event trigger.

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.

Memory corruption while copying the result to the transmission queue in EMAC.

Memory corruption while retrieving the CBOR data from TA.

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.

Memory corruption may occur while attaching VM when the HLOS retains access to VM.

In the Linux kernel, the following vulnerability has been resolved: irqchip/qcom-mpm: Prevent crash when trying to handle non-wake GPIOs On Qualcomm chipsets not all GPIOs are wakeup capable. Those GPIOs do not have a corresponding MPM pin and should not be handled inside the…

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value.

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.

Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call.

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.

Memory corruption while reading the FW response from the shared queue.

Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit.

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

Memory corruption during the FRS UDS generation process.

Memory corruption while triggering commands in the PlayReady Trusted application.

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

Memory corruption while reading secure file.

Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due to a missing memory requirement check.

Memory corruption while acquire and update IOCTLs during IFE output resource ID validation.

Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information.

Memory corruption while prociesing command buffer buffer in OPE module.

Memory corruption Camera kernel when large number of devices are attached through userspace.

Memory corruption during array access in Camera kernel due to invalid index from invalid command data.

Memory corruption while encoding JPEG format.

Memory corruption during concurrent buffer access due to modification of the reference count.

Memory corruption when blob structure is modified by user-space after kernel verification.

Memory corruption during concurrent access to server info object due to incorrect reference count update.

Memory corruption during concurrent SSR execution due to race condition on the global maps list.

Memory corruption may occur while processing device IO control call for session control.

Memory corruption while processing message content in eAVB.

Memory corruption while transmitting packet mapping information with invalid header payload size.

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer.