Vendor
Qualcomm
3,001 known vulnerabilities.
Products
3,001 results · Feed
-
Medium 6.7
Multiple Dmabuf Kernel Address UAF Vulnerability
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which caus…
-
Medium 6.4
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel Driver
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel…
-
Medium 6.7
Multiple Type Confusion Vulnerability
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
-
Critical 9.8
Buffer Copy Without Checking Size of Input in QESL
Memory corruption in QESL while processing payload from external ESL device to firmware.
-
High 7.5
Buffer Over-read in Audio
Transient DOS in Audio while remapping channel buffer in media codec decoding.
-
High 8.4
Integer Overflow or Wraparound in Audio
Memory corruption while allocating memory in COmxApeDec module in Audio.
-
High 8.4
Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while playing amrwbplus clips with modified content.
-
High 7.7
Key Management Errors in HLOS
Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.
-
Critical 9.3
Incorrect Type Conversion or Cast in Core
Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.
-
Medium 6.7
Improper Validation of Array Index in GPS HLOS Driver
Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN
Memory corruption in WLAN while running doDriverCmd for an unspecific command.
-
Medium 6.7
Integer Overflow to Buffer Overflow in RIL
Memory corruption in RIL while trying to send apdu packet.
-
Medium 6.5
Improper Input Validation in Bluetooth HOST
Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.
-
Critical 9.1
Untrusted Pointer Dereference in Automotive
Memory corruption due to untrusted pointer dereference in automotive during system call.
-
Medium 6.7
Incorrect Type Conversion or Cast in Trusted Execution Environment
Memory corruption in Trusted Execution Environment while calling service API with invalid address.
-
High 7.1
Improper Authentication in HLOS.
Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.
-
High 8.2
Buffer Over-read in Network Services
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
-
Critical 9.8
Buffer copy without checking size of input in Audio.
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
-
High 7.8
Buffer Over-read in WLAN HOST
Memory Corruption in WLAN HOST while fetching TX status information.
-
High 7.8
Buffer Over-read in WLAN Host
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
-
High 7.8
Stack-based Buffer Overflow in WLAN HOST
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
-
High 7.8
Buffer Copy Without Checking Size of Input in WLAN HOST
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
-
High 8.4
Integer Overflow or Wraparound in Audio
Memory Corruption in Audio while allocating the ion buffer during the music playback.
-
High 7.8
Use of Out-of-range Pointer Offset in Qualcomm IPC
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
-
High 7.8
Buffer Copy Without Checking Size of Input in WLAN HOST
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
-
Medium 6.6
Permissions, Privileges, and Access Controls in Display
An app with non-privileged access can change global system brightness and cause undesired system behavior.
-
High 8.4
Use After Free in Audio
Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Linux
Memory corruption in Linux when the file upload API is called with parameters having large buffer.
-
Medium 6.7
Buffer Copy Without Checking the Size of Input in Audio
Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client.
-
Medium 6.7
Incorrect Type Conversion or Cast in Video
Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.
-
Medium 6.7
Improper Restrictions of Operations within the Bounds of a Memory Buffer in Linux
Memory corruption in Linux while calling system configuration APIs.
-
Medium 6.7
Buffer Copy without Checking Size of Input in Data Network Stack & Connectivity
Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony.
-
Medium 6.7
Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
-
High 7.5
Improper Input Validation in Modem
Weak Configuration due to improper input validation in Modem while processing LTE security mode command message received from network.
-
Medium 6.8
Double Free in Modem
Memory Corruption in Modem due to double free while parsing the PKCS15 sim files.
-
Medium 6.2
Information Exposure in DSP Services
Information disclosure in DSP Services while loading dynamic module.
-
High 7.8
Improper Access control in GPU Subsystem
Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
-
High 8.2
Buffer Over-read in WLAN HOST
Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing WLAN beacon or probe-response frame.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing FT Information Elements.