997 results · Feed
-
High 7.8
Use After Free in DSP Service
Memory corruption during concurrent SSR execution due to race condition on the global maps list.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS may occur while parsing SSID in action frames.
-
High 7.8
Improper Validation of Array Index in Computer Vision
Memory corruption may occur while processing device IO control call for session control.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Automotive Vehicle Networks
Memory corruption while processing message content in eAVB.
-
High 7.8
Integer Overflow to Buffer Overflow in Automotive Vehicle Networks
Memory corruption while transmitting packet mapping information with invalid header payload size.
-
High 7.8
Out-of-bounds Read in Windows WLAN Host
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
-
High 7.8
Out-of-bounds Read in Windows WLAN Host
Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.
-
High 7.8
Out-of-bounds Read in Windows WLAN Host
Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer.
-
High 7.8
Out-of-bounds Read in Windows WLAN Host
Memory corruption while IOCTL call is invoked from user-space to read board data.
-
High 7.8
Use After Free in Automotive Linux OS
Memory corruption while processing memory map or unmap IOCTL operations simultaneously.
-
High 7.8
Use After Free in DSP Service
Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS may occur while parsing extended IE in beacon.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS may occur while parsing EHT operation IE or EHT capability IE.
-
Medium 5.5
Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform
Information disclosure may be there when a guest VM is connected.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.
-
High 7.5
Buffer Over-read in WLAN Host
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.
-
High 7.5
Buffer Over-read in WLAN Host
Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.
-
High 7.3
Improper Access Control in Automotive Linux OS
Memory corruption may occur due top improper access control in HAB process.
-
High 7.8
Improper Validation of Array Index in Display
Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.
-
High 7.8
Buffer Over-read in Display
Memory corruption while processing escape code in API.
-
Medium 6.7
Use After Free in DSP Service
Memory corruption while processing multiple IOCTL calls from HLOS to DSP.
-
High 7.8
Use of Out-of-range Pointer Offset in Trust Management Engine
Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.
-
Medium 6.5
Improper Access Control for Register Interface in TZ Firmware
Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.
-
High 8.2
Buffer Over-read in Data Network Stack & Connectivity
Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.
-
Medium 6.2
Weak Authentication in HLOS
Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.
-
High 7.7
Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL
Information disclosure while creating MQ channels.
-
Medium 6.6
Use After Free in Data Network Stack & Connectivity
Memory corruption while processing IOCTL calls to add route entry in the HW.
-
Medium 6.6
Out-of-bounds Write in Audio
Memory corruption while accessing MSM channel map and mixer functions.
-
Medium 6.6
Use After Free in HLOS
Memory corruption while invoking IOCTL map buffer request from userspace.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Camera
Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.
-
High 7.8
Use After Free in HLOS
Memory corruption while handling file descriptor during listener registration/de-registration.
-
High 7.1
Exposed Dangerous Method or Function in HLOS
Cryptographic issues while generating an asymmetric key pair for RKP use cases.
-
High 7.8
Incorrect Type Conversion or Cast in Multimedia Frameworks
Memory corruption while processing IOCTL calls.
-
Medium 5.5
Information Exposure in TZ Secure OS
There may be information disclosure during memory re-allocation in TZ Secure OS.
-
High 7.5
Insufficient Granularity of Access Control in Core
Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.
-
High 7.8
Use After Free in NPU
Memory corruption while calling the NPU driver APIs concurrently.
-
High 7.8
Untrusted Pointer Dereference in DSP_Services
Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset.
-
High 7.8
Untrusted Pointer Dereference in DSP_Services
Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address.
-
High 7.8
Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS Platform
Memory corruption may occur in keyboard virtual device due to guest VM interaction.
-
High 7.8
Improper Input Validation in Automotive OS Platform
Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine.