Vulnerabilidades

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

Memory corruption while processing frame command IOCTL calls.

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,

Memory corruption while processing IPA statistics, when there are no active clients registered.

Memory corruption while processing IOCTL call for getting group info.

Memory corruption when two threads try to map and unmap a single node simultaneously.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.

Memory corruption when user provides data for FM HCI command control operations.

Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.

Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.

Memory corruption while playing audio file having large-sized input buffer.

Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.

Memory corruption while verifying the serialized header when the key pairs are generated.

Memory corruption in HLOS while checking for the storage type.

Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.

Memory corruption while processing Codec2 during v13k decoder pitch synthesis.

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

Transient DOS while processing DL NAS TRANSPORT message with payload length 0.

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification.