Vulnerabilities

Transient DOS when processing authentication frames with invalid FILS information element header lengths.

Transient DOS when a remote device sends an invalid connection request during BT connectable LE scan.

Memory corruption while processing a malformed license file during reboot.

Memory corruption during PlayReady APP usecase while processing TA commands.

Transient DOS while parsing the EPTM test control message to get the test pattern.

Memory corruption while performing private key encryption in trusted application.

Transient DOS while processing an ANQP message.

Information disclosure while processing the hash segment in an MBN file.

Information disclosure while reading data from an image using specified offset and size parameters.

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

Memory corruption while retrieving the CBOR data from TA.

Memory corruption while reading secure file.

Memory corruption may occur while reading board data via IOCTL call when the WLAN driver copies the content to the provided output buffer.

Memory corruption while IOCTL call is invoked from user-space to read board data.

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification failure, potentially leading to a user throttling bypass.

There may be information disclosure during memory re-allocation in TZ Secure OS.

Information disclosure while deriving keys for a session for any Widevine use case.

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

Memory corruption when IOCTL call is invoked from user-space to read board data.

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

memory corruption when an invalid firehose patch command is invoked.

Cryptographic issue while parsing RSA keys in COBR format.

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.