601 matches found
CVE-2024-33029 Use After Free in DSP Services
Memory corruption while handling the PDR in driver for getting the remote heap maps...
CVE-2024-33029 Use After Free in DSP Services
Memory corruption while handling the PDR in driver for getting the remote heap maps...
The vulnerability of the cs_dsp_dbg() function (located in the drivers/firmware/cirrus/cs_dsp.c file of the Linux kernel) allows an attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the csdspdbg function located in the drivers/firmware/cirrus/csdsp.c file of the Linux kernel is related to the occurrence of operations outside the buffer boundaries in memory when processing the wmfw header. Exploitation of this vulnerability could allow an attacker to...
kernel: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
A buffer overrun flaw exists in the Linux kernel when the strlen function is used on name fields in V1 wmfw files. This issue results in a loss of system availability...
Qualcomm Urges OEMs to Patch Critical DSP and WLAN Flaws Amid Active Exploits
Qualcomm has rolled out security updates to address nearly two dozen flaws spanning proprietary and open-source components, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2024-43047 CVSS score: 7.8, has been described as a...
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
Multiple Qualcomm chipsets contain a use-after-free vulnerability due to memory corruption in DSP Services while maintaining memory maps of HLOS memory...
CVE-2024-43047 Use After Free in DSP Service
Memory corruption while maintaining memory maps of HLOS memory...
CVE-2024-43047 Use After Free in DSP Service
Memory corruption while maintaining memory maps of HLOS memory...
CVE-2024-23379 Double Free in DSP Services
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario...
CVE-2024-23379 Double Free in DSP Services
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario...
CVE-2024-21455 Untrusted Pointer Dereference in DSP Service
Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver...
CVE-2024-21455 Untrusted Pointer Dereference in DSP Service
Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver...
MAL-2024-9076 Malicious code in dsp_login_front (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7af276e10932b2793bd4d19b246087ea006054e2fa3f0cc1907fd11be997b747 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
A vulnerability was found in the Linux kernel in the csdsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an...
kernel: firmware: cs_dsp: Fix overflow checking of wmfw header
A vulnerability was found in the Linux kernel's firmware driver csdsp.c, where a buffer overflow is possible in the wmfw header due to insufficient buffer size checks. The issue stems from the size of one of the structs that the code checks, the wmfwadsp?sizes struct, which can vary depending on...
kernel: firmware: cs_dsp: Validate payload length before processing block
In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...
kernel: firmware: cs_dsp: Return error if block header overflows file
A denial of service vulnerability was found in the Linux kernel. No error was returned from the csdsppowerup function if a block header is longer than the amount of data left in the file...
kernel: firmware: cs_dsp: Return error if block header overflows file
A denial of service vulnerability was found in the Linux kernel. No error was returned from the csdsppowerup function if a block header is longer than the amount of data left in the file...
kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
A vulnerability was found in the Linux kernel in the csdsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an...
kernel: firmware: cs_dsp: Validate payload length before processing block
In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...