Qualcomm

Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.

Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.

Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.

Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.

Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.

An app with non-privileged access can change global system brightness and cause undesired system behavior.

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.

Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer.

Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration.

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions (ESR=0x96000010) and kernel crashes on Monaco-based platforms. These faults are caused…

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

Transient DOS when processing target power rate tables during channel configuration.

Memory Corruption when accessing freed memory due to concurrent fence deregistration and signal handling.

Transient DOS when MAC configures config id greater than supported maximum value.

Transient DOS when an LTE RLC packet with invalid TB is received by UE.

Transient DOS when processing a received frame with an excessively large authentication information element.

Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element.

Information disclosure while processing system calls with invalid parameters.

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.

Information disclosure may occur while processing the hypervisor log.

Information disclosure while processing the hash segment in an MBN file.

Information disclosure while reading data from an image using specified offset and size parameters.

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network.

Information disclosure while handling beacon probe frame during scan entry generation in client side.

Information disclosure while handling beacon or probe response frame in STA.

Information disclosure while parsing sub-IE length during new IE generation.

Information disclosure while handling SA query action frame.

INformation disclosure while handling Multi-link IE in beacon frame.

Information Disclosure while parsing beacon frame in STA.

Information disclosure while handling T2LM Action Frame in WLAN Host.

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.

The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid.…

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.

Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music

Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilege and the Administrator users API Keys.

Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

RPM secure Stream can access any secure resource due to improper SMMU configuration and can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

Possible memory corruption in BT controller when it receives an oversized LMP packet over 2-DH1 link and leads to denial of service in BlueCore

Improper validation of LLM utility timers availability can lead to denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Improper handling of resource allocation in virtual machines can lead to information exposure in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Improper handling of ASB-C broadcast packets with crafted opcode in LMP can lead to uncontrolled resource consumption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…

Improper Access Control when ACL link encryption is failed and ACL link is not disconnected during reconnection with paired device in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Improper handling of ASB-U packet with L2CAP channel ID by slave host can lead to interference with piconet in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon…

Image address is dereferenced before validating its range which can cause potential QSEE information leakage in Snapdragon Wired Infrastructure and Networking