Qualcomm

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls.

Memory corruption while processing FIPS encryption or decryption validation functionality IOCTL call.

Memory corruption while processing IOCTL call invoked from user-space to verify non extension FIPS encryption and decryption functionality.

Memory corruption while processing FIPS encryption or decryption IOCTL call invoked from user-space.

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

Memory corruption when IOCTL call is invoked from user-space to read board data.

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.

Memory corruption while processing API calls to NPU with invalid input.

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.

Memory corruption when invalid input is passed to invoke GPU Headroom API call.

Crafted Binder Request Causes Heap UAF in MediaServer

Memory corruption during GNSS HAL process initialization.

Memory corruption while processing GPU page table switch.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while processing GPU commands.

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Memory corruption while handling session errors from firmware.

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while station LL statistic handling.

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.

Memory corruption while handling IOCTL calls in JPEG Encoder driver.

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.

Memory corruption while processing IOCTL call for getting group info.

Memory corruption while processing concurrent IOCTL calls.

Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.

Memory corruption when user provides data for FM HCI command control operations.

Memory corruption when Alternative Frequency offset value is set to 255.

Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.

Memory corruption during session sign renewal request calls in HLOS.

Memory corruption when keymaster operation imports a shared key.

Memory corruption when allocating and accessing an entry in an SMEM partition.

Memory corruption while processing key blob passed by the user.

Memory corruption while copying a keyblob`s material when the key material`s size is not accurately checked.

Memory corruption when the channel ID passed by user is not validated and further used.

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

An improper input validation in the Qualcom plctool allows a local attacker with low privileges to gain root access by changing the ownership of specific files.

Memory corruption while processing a QMI request for allocating memory from a DHMS supported subsystem.

Memory corruption when malformed message payload is received from firmware.

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.

Memory corruption in Audio when memory map command is executed consecutively in ADSP.

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.

Memory corruption in wearables while processing data from AON.

Memory corruption in Core while processing RX intent request.