Vulnerabilidades

Memory corruption when programming registers through virtual CDM.

Memory corruption while submitting blob data to kernel space though IOCTL.

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

Information disclosure may occur while processing goodbye RTCP packet from network.

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

Memory corruption may occur while processing the OIS packet parser.

Memory corruption while processing I2C settings in Camera driver.

Memory corruption may occur while attaching VM when the HLOS retains access to VM.

Transient DOS may occur while parsing SSID in action frames.

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Memory corruption while processing multiple IOCTL calls from HLOS to DSP.

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.

Information disclosure while creating MQ channels.

Memory corruption while invoking IOCTL map buffer request from userspace.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Cryptographic issues while generating an asymmetric key pair for RKP use cases.

Memory corruption while processing IOCTL calls.

There may be information disclosure during memory re-allocation in TZ Secure OS.

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.