Vulnerabilidades

Information disclosure while processing IO control commands.

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.

Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.

Memory corruption while processing API calls to NPU with invalid input.

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.

Memory corruption when invalid input is passed to invoke GPU Headroom API call.

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

Memory corruption during GNSS HAL process initialization.

Memory corruption while processing GPU page table switch.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while station LL statistic handling.

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.

Memory corruption while handling IOCTL calls in JPEG Encoder driver.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Memory corruption while processing the update SIM PB records request.

memory corruption when WiFi display APIs are invoked with large random inputs.

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.

Memory corruption when two threads try to map and unmap a single node simultaneously.