Vulnerabilidades

An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'

Information disclosure possible while audio playback.

Information disclosure due to uninitialized variable.

An image with a version lower than the fuse version may potentially be booted lead to improper authentication.

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.

In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation.

Buffer overwrite in the WLAN host driver by leveraging a compromised WLAN FW

On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.

Initial xbl_sec revision does not have all the debug policy features and critical checks.

Certain unprivileged processes are able to perform IOCTL calls.

Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.

Transient DOS in Automotive OS due to improper authentication to the secure IO calls.

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.

Memory corruption while using the UIM diag command to get the operators name.

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

Memory corruption in Audio while processing the VOC packet data from ADSP.

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.

Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.

Memory corruption while allocating memory in COmxApeDec module in Audio.

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.

Transient DOS due to improper authorization in Modem

Memory corruption due to double free in Core while mapping HLOS address to the list.

Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.