Vulnerabilities

Memory corruption while processing a GP command response.

Memory corruption during PlayReady APP usecase while processing TA commands.

Cryptographic issue while performing RSA PKCS padding decoding.

Memory corruption while handling client exceptions, allowing unauthorized channel access.

Memory corruption during concurrent access to server info object due to unprotected critical field.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session.

Memory corruption while handling file descriptor during listener registration/de-registration.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'

An image with a version lower than the fuse version may potentially be booted lead to improper authentication.

Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user.

Certain unprivileged processes are able to perform IOCTL calls.

Memory corruption while processing GPU page table switch.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption when two threads try to map and unmap a single node simultaneously.

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

Transient DOS while parsing ESP IE from beacon/probe response frame.

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.

Memory corruption when allocating and accessing an entry in an SMEM partition.

Memory corruption while performing finish HMAC operation when context is freed by keymaster.

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.

Memory corruption when there is failed unmap operation in GPU.

Memory corruption while processing finish_sign command to pass a rsp buffer.

Memory corruption in SPS Application while requesting for public key in sorter TA.