Vulnerabilidades

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

Information disclosure may occur while processing goodbye RTCP packet from network.

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

Memory corruption while processing IOCTL command to handle buffers associated with a session.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Memory corruption while processing multiple IOCTL calls from HLOS to DSP.

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.

Memory corruption while accessing MSM channel map and mixer functions.

Memory corruption while invoking IOCTL map buffer request from userspace.

Memory corruption while handling file descriptor during listener registration/de-registration.

Cryptographic issues while generating an asymmetric key pair for RKP use cases.

There may be information disclosure during memory re-allocation in TZ Secure OS.

Memory corruption during GNSS HAL process initialization.

Information disclosure while sending implicit broadcast containing APP launch information.

Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.

memory corruption when an invalid firehose patch command is invoked.

Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).

Cryptographic issue while parsing RSA keys in COBR format.

Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.