Use After Free in DSP Services

Improper Input Validation in WIN SON

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host

Buffer Copy without Checking Size of Input in WLAN Firmware

Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame

Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length

Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames

An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapdragon Auto, Snapdragon Compute, Snapdragon…

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Possible buffer overflow due to lack of parameter length check during MBSSID scan IE parse in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile,…

Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Possible buffer over read due to lack of length check while parsing beacon IE response in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…

Buffer over-read can happen while processing WPA,RSN IE of beacon and response frames if IE length is less than length of frame pointer being accessed in Snapdragon Auto,…

Possible out of bound read while WLAN frame parsing due to lack of check for body and header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon…

Possible buffer over read while processing P2P IE and NOA attribute of beacon and probe response frames due to improper validation of P2P IE and NOA attribute lengths in…

Possible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE length in received beacon in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…

Missing Authentication for Critical Function in Boot

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Qualcomm IPC

Improper Input Validation in Services

NULL pointer dereference in WLAN Firmware

Buffer Copy Without Checking Size of Input in WLAN Host

Improper Validation of Array Index in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Use of Out-of-range Pointer Offset in WLAN HAL

Buffer Copy Without Checking Size of Input in WLAN HAL

Buffer Copy Without Checking Size of Input in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HAL

Improper Validation of Array Index in WLAN HAL

Buffer Copy without Checking the Size of Input in WLAN Firmware

Improper validation of array index in WLAN HAL

Buffer Over-read in WLAN Host

Use of Out-of-range Pointer Offset in Qualcomm IPC

Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HAL

Integer overflow or wraparound in WLAN

Incorrect type conversion in WLAN

Buffer copy without checking the size of input in WLAN HAL.

Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command

Memory corruption due to improper access control in Qualcomm IPC

Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command

Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…

Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Improper validation of data length received from DMA buffer can lead to memory corruption

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Possible assertion in QOS request due to improper validation when multiple add or update request are received simultaneously in Snapdragon Auto, Snapdragon Compute, Snapdragon…