Vulnerabilidades

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.

Memory corruption while handling file descriptor during listener registration/de-registration.

There may be information disclosure during memory re-allocation in TZ Secure OS.

Memory corruption while calling the NPU driver APIs concurrently.

Transient DOS may occur while processing the country IE.

Information disclosure while deriving keys for a session for any Widevine use case.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

Memory corruption while processing GPU page table switch.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Memory corruption while handling session errors from firmware.

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Memory corruption while maintaining memory maps of HLOS memory.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Memory corruption while processing IOCTL call for getting group info.

Memory corruption while processing concurrent IOCTL calls.

Memory corruption when two threads try to map and unmap a single node simultaneously.

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

memory corruption when an invalid firehose patch command is invoked.

Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).

Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.