Qualcomm

Memory corruption while processing the update SIM PB records request.

Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size.

Memory corruption while handling the PDR in driver for getting the remote heap maps.

memory corruption when WiFi display APIs are invoked with large random inputs.

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.

Memory corruption during the network scan request.

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.

memory corruption when an invalid firehose patch command is invoked.

Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.

Memory corruption when more scan frequency list or channels are sent from the user space.

Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.

Information disclosure while parsing dts header atom in Video.

Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.

Memory corruption while copying the sound model data from user to kernel buffer during sound model register.

Memory corruption when the bandpass filter order received from AHAL is not within the expected range.

Memory corruption when multiple listeners are being registered with the same file descriptor.

Memory corruption in HLOS while converting from authorization token to HIDL vector.

Memory corruption in Audio while processing the calibration data returned from ACDB loader.

Memory corruption in Audio while processing IIR config data from AFE calibration block.

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.

Memory corruption while receiving a message in Bus Socket Transport Server.

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.

Memory corruption while sending SMS from AP firmware.

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.

Memory Corruption in Audio while invoking IOCTLs calls from the user-space.

Memory Corruption in camera while installing a fd for a particular DMA buffer.

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.

Memory corruption while processing audio effects.

Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ).

Memory Corruption while accessing metadata in Display.

Memory corruption in Audio while validating and mapping metadata.

Memory corruption in Audio during playback session with audio effects enabled.

Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request.

Memory Corruption due to improper validation of array index in Linux while updating adn record.

Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.

In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel…

The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.

Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.

Memory corruption in WLAN while running doDriverCmd for an unspecific command.

Memory corruption in RIL while trying to send apdu packet.

Memory corruption in Trusted Execution Environment while calling service API with invalid address.

Memory corruption in Linux when the file upload API is called with parameters having large buffer.

Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.

Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.