Vulnerabilidades

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.

Cryptographic issue while performing RSA PKCS padding decoding.

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

Information disclosure may occur while processing goodbye RTCP packet from network.

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

Memory corruption while processing IOCTL command to handle buffers associated with a session.

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

Memory corruption during concurrent access to server info object due to unprotected critical field.

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.

Transient DOS may occur while processing the country IE.

While processing the authentication message in UE, improper authentication may lead to information disclosure.

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Crafted Binder Request Causes Heap UAF in MediaServer

Memory corruption while processing GPU page table switch.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.

Memory corruption when two threads try to map and unmap a single node simultaneously.

Memory corruption when user provides data for FM HCI command control operations.

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.