Vendor
Qualcomm
3,001 known vulnerabilities.
Products
317 results · Clear filters · Feed
-
Medium 6.6
Use After Free in HLOS
Memory corruption during concurrent access to server info object due to unprotected critical field.
-
Medium 5.5
Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform
Information disclosure may be there when a guest VM is connected.
-
Medium 6.7
Use After Free in DSP Service
Memory corruption while processing multiple IOCTL calls from HLOS to DSP.
-
Medium 6.5
Improper Access Control for Register Interface in TZ Firmware
Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.
-
Medium 6.2
Weak Authentication in HLOS
Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.
-
Medium 6.6
Use After Free in Data Network Stack & Connectivity
Memory corruption while processing IOCTL calls to add route entry in the HW.
-
Medium 6.6
Out-of-bounds Write in Audio
Memory corruption while accessing MSM channel map and mixer functions.
-
Medium 6.6
Use After Free in HLOS
Memory corruption while invoking IOCTL map buffer request from userspace.
-
Medium 5.5
Information Exposure in TZ Secure OS
There may be information disclosure during memory re-allocation in TZ Secure OS.
-
Medium 5.5
Integer Overflow or Wraparound in BT Controller
Transient DOS can occur while processing UCI command.
-
Medium 5.5
Buffer Over-read in Hypervisor
Transient DOS during hypervisor virtual I/O operation in a virtual machine.
-
Medium 5.5
Improper Authorization in SPS-HLOS
Information disclosure while deriving keys for a session for any Widevine use case.
-
Medium 5.4
Improper Authentication in Modem
While processing the authentication message in UE, improper authentication may lead to information disclosure.
-
Medium 6.1
Buffer Over-read in Automotive Multimedia
Information disclosure while processing IO control commands.
-
Medium 6.1
Buffer Over-read in Audio
Information disclosure during audio playback.
-
Medium 6.1
Buffer Over-read in Computer Vision
Information disclosure while processing information on firmware image during core initialization.
-
Medium 6.6
Improper Input Validation in Computer Vision
Memory corruption while processing frame packets.
-
Medium 6.6
Use After Free in Computer Vision
Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.
-
Medium 6.6
Use After Free in Computer Vision
Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.
-
Medium 5.5
Buffer Over-read in Automotive OS Platform
Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.
-
Medium 6.1
Buffer Over-read in Automotive Autonomy
information disclosure while invoking the mailbox read API.
-
Medium 6.1
Buffer Over-read in Audio
Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.
-
Medium 6.8
Buffer Over-read in DSP Service
Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.
-
Medium 6.7
Use After Free in Computer Vision
Memory corruption while processing frame command IOCTL calls.
-
Medium 6.7
Use After Free in Computer Vision
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
-
Medium 6.7
Use of Out-of-range Pointer Offset in Computer Vision
Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,
-
Medium 6.6
Buffer Over-read in Automotive Autonomy
Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.
-
Medium 6.7
Use After Free in Video
Memory corruption when multiple threads try to unregister the CVP buffer at the same time.
-
Medium 6.7
Use After Free in Camera Driver
Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.
-
Medium 6.7
Untrusted Pointer Dereference in Audio
Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.
-
Medium 6.1
Buffer Over-read in Neural Processing Unit
Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.
-
Medium 6.7
Use of Out-of-range Pointer Offset in Camera Driver
Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.
-
Medium 6.8
Use After Free in WLAN
A race condition exists in a driver potentially leading to a use-after-free condition.
-
Medium 6.7
Improper Input Validation in Audio
Possible out of bound access in audio module due to lack of validation of user provided input.
-
Medium 6.7
Permissions, Privileges, and Access Controls in Data
Certain unprivileged processes are able to perform IOCTL calls.
-
Medium 6.7
Use After Free in ComputerVision
Memory corruption while processing IOCTL calls to unmap the buffers.
-
Medium 6.7
Improper Validation of Array Index in Camera_Linux
Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.
-
Medium 6.7
Improper Input Validation in RIL
Memory corruption while processing the update SIM PB records request.
-
Medium 6.7
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Performance
Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size.
-
Medium 6.7
Use After Free in DSP Services
Memory corruption while handling the PDR in driver for getting the remote heap maps.