Vulnerabilidades

Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.

Transient DOS in WLAN Firmware while parsing rsn ies.

Transient DOS in WLAN Firmware while parsing a NAN management frame.

Transient DOS in Modem while allocating DSM items.

Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.

Memory corruption in WLAN HAL while parsing WMI command parameters.

Memory corruption in WLAN HAL while handling command through WMI interfaces.

Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.

Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.

Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.

Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.

Transient DOS in WLAN Firmware while processing frames with missing header fields.

information disclosure due to cryptographic issue in Core during RPMB read request.

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.

Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.

Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.

Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.

Information disclosure due to buffer over-read in WLAN while parsing NMF frame.

Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.

Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.