Vulnerabilidades

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.

An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'

Crafted Binder Request Causes Heap UAF in MediaServer

Information disclosure possible while audio playback.

Information disclosure due to uninitialized variable.

QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable memory.

An image with a version lower than the fuse version may potentially be booted lead to improper authentication.

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.

A race condition exists in a driver potentially leading to a use-after-free condition.

In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.

Buffer overwrite in the WLAN host driver by leveraging a compromised WLAN FW

On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.

Initial xbl_sec revision does not have all the debug policy features and critical checks.

Possible out of bound access in audio module due to lack of validation of user provided input.

Certain unprivileged processes are able to perform IOCTL calls.

Memory corruption during GNSS HAL process initialization.

Memory corruption while processing GPU page table switch.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while processing GPU commands.

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Memory corruption while handling session errors from firmware.

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while station LL statistic handling.

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.