241 results · Clear filters · Feed
-
Medium 6.7
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.
-
Medium 6.1
Buffer Over-read in Audio
Information disclosure in Audio while accessing AVCS services from ADSP payload.
-
Medium 5.5
Buffer Over-read in Audio
Transient DOS in Audio when invoking callback function of ASM driver.
-
Medium 6.7
Integer Overflow or Wraparound in Radio Interface Layer
Memory corruption while receiving a message in Bus Socket Transport Server.
-
Medium 6.7
Double Free in Data Network Stack & Connectivity
Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Radio Interface Layer
Memory corruption while sending SMS from AP firmware.
-
Medium 6.0
Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in WLAN Host
Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in WLAN Host
Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.
-
Medium 6.7
Use After Free in Audio
Memory Corruption in Audio while invoking IOCTLs calls from the user-space.
-
Medium 6.7
Use After Free in Camera
Memory Corruption in camera while installing a fd for a particular DMA buffer.
-
Medium 6.7
Improper Restriction of Operations within the Bounds of a Memory Buffer in Radio Interface Layer
Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
-
Medium 6.6
Buffer Over-read in WLAN HOST
Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.
-
Medium 6.7
Buffer Copy without Checking Size of Input in Audio
Memory corruption while processing audio effects.
-
Medium 6.1
Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL while handling command through WMI interfaces.
-
Medium 6.1
Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL when reception status handler is called.
-
Medium 6.1
Buffer Over-read in WLAN HAL
Information disclosure in WLAN HAL while handling the WMI state info command.
-
Medium 6.1
Buffer Over-read in IOE Firmware
Information disclosure in IOE Firmware while handling WMI command.
-
Medium 6.1
Buffer Over-read in Qualcomm IPC
Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
-
Medium 6.1
Buffer Over-read in WLAN Host
Information Disclosure in WLAN Host when processing WMI event command.
-
Medium 6.1
Buffer Over-read in WLAN HOST
Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.
-
Medium 6.6
Buffer Copy Without Checking Size of Input in WLAN Host
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in VR Service
Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ).
-
Medium 6.5
Buffer Over-read in Bluetooth HOST
Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.
-
Medium 6.7
Improper Restrictions of Operations within the Bounds of a Memory Buffer in Display
Memory Corruption while accessing metadata in Display.
-
Medium 6.7
Integer Overflow or Wraparound in Display
Memory corruption in Audio while validating and mapping metadata.
-
Medium 6.7
Improper Restriction of Operations within the Bounds of a Memory Buffer in Audio
Memory corruption in Audio during playback session with audio effects enabled.
-
Medium 6.7
Integer Overflow to Buffer Overflow in RIL
Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request.
-
Medium 6.7
Improper Validation of Array Index in Linux
Memory Corruption due to improper validation of array index in Linux while updating adn record.
-
Medium 6.7
Buffer over-read in Modem
Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.
-
Medium 5.1
Buffer over-read in Automotive multimedia
Information disclosure in Automotive multimedia due to buffer over-read.
-
Medium 6.7
Multiple Dmabuf Kernel Address UAF Vulnerability
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which caus…
-
Medium 6.4
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel Driver
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel…
-
Medium 6.7
Multiple Type Confusion Vulnerability
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
-
Medium 6.7
Improper Validation of Array Index in GPS HLOS Driver
Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN
Memory corruption in WLAN while running doDriverCmd for an unspecific command.
-
Medium 6.7
Integer Overflow to Buffer Overflow in RIL
Memory corruption in RIL while trying to send apdu packet.
-
Medium 6.5
Improper Input Validation in Bluetooth HOST
Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.
-
Medium 6.7
Incorrect Type Conversion or Cast in Trusted Execution Environment
Memory corruption in Trusted Execution Environment while calling service API with invalid address.
-
Medium 6.6
Permissions, Privileges, and Access Controls in Display
An app with non-privileged access can change global system brightness and cause undesired system behavior.