Qualcomm

Improper Validation of Array Index in Multimedia While parsing an mp4 file in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, an out-of-bounds access can occur.

In Android before 2017-08-05 on Qualcomm MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, if kernel memory address is passed from userspace through iris_vidioc_s_ext_ctrls ioctl, it will print kernel address data. A user could set…

In the Linux kernel, the following vulnerability has been resolved: serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ When uart_flush_buffer() runs before the DMA completion IRQ is delivered, the following race can occur (all steps serialized by…

Information Disclosure while processing IOCTL handler callbacks without verifying buffer size.

Information disclosure while processing a firmware event.

Information disclosure while processing message from client with invalid payload.

Information disclosure while registering commands from clients with diag through diagHal.

Information disclosure while processing batch command execution in Video driver.

Information disclosure when Video engine escape input data is less than expected minimum size.

Information disclosure while running video usecase having rogue firmware.

information disclosure while invoking calibration data from user space to update firmware size.

Information disclosure while opening a fastrpc session when domain is not sanitized.

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.

Information disclosure while processing IO control commands.

Information disclosure during audio playback.

Information disclosure while processing information on firmware image during core initialization.

information disclosure while invoking the mailbox read API.

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.

Information disclosure while sending implicit broadcast containing APP launch information.

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.

transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA.

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.

Information disclosure in Audio while accessing AVCS services from ADSP payload.

Information disclosure in WLAN HAL while handling command through WMI interfaces.

Information disclosure in WLAN HAL when reception status handler is called.

Information disclosure in WLAN HAL while handling the WMI state info command.

Information disclosure in IOE Firmware while handling WMI command.

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.

Information Disclosure in WLAN Host when processing WMI event command.

Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.

Information disclosure in DSP Services while loading dynamic module.

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request.

Information Disclosure in Graphics during GPU context switch.

Denial of service in MODEM due to improper pointer handling

Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Denial of service in multimedia due to uncontrolled resource consumption while parsing an incoming HAB message in Snapdragon Auto

A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Improper validation of permissions for third party application accessing Telephony service API can lead to information disclosure in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

Lack of validation for third party application accessing the service can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Improper validation of kernel buffer address while copying information back to user buffer can lead to kernel memory information exposure to user space in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice…

Improper validation of kernel buffer address while copying information back to user buffer can lead to kernel memory information exposure to user space in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice…

Lack of strict validation of bootmode can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Child process can leak information from parent process due to numeric pids are getting compared and these pid can be reused in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &…

Memory corruption during buffer allocation due to dereferencing session ctx pointer without checking if pointer is valid in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file.

Information exposure in DSP services due to improper handling of freeing memory