Vulnerabilidades

The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

Transient DOS in WLAN Firmware while parsing a BTM request.

Memory corruption in Audio during playback with speaker protection.

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Memory corruption in HLOS while running playready use-case.

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

Memory corruption when processing cmd parameters while parsing vdev.

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Memory corruption while loading an ELF segment in TEE Kernel.

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

Memory Corruption in SPS Application while exporting public key in sorter TA.

Information disclosure in IOE Firmware while handling WMI command.

Cryptographic issue in HLOS during key management.

Memory corruption in TZ Secure OS while loading an app ELF.

Memory Corruption in Core due to secure memory access by user while loading modem image.

Transient DOS in WLAN Firmware while parsing rsn ies.

Transient DOS in Modem while allocating DSM items.

Memory corruption in WLAN HAL while handling command through WMI interfaces.

Memory corruption in WLAN HAL while handling command streams through WMI interfaces.

Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.

Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.