CVE-2017-8247

In all Qualcomm products with Android releases from CAF using the Linux kernel, if there is more than one thread doing the device open operation, the device may be opened more than once. This would lead to getpid being called more than once, however putpid being called only once in function...

CVE-2017-9724

In all Qualcomm products with Android releases from CAF using the Linux kernel, user-level permissions can be used to gain access to kernel memory, specifically the ION cache maintenance code is writing to a user supplied address...

CVE-2017-9677

CVE-2017-9677 affects Qualcomm components, specifically the Audio driver, in CAF Android builds using the Linux kernel. The issue arises in msm_compr_ioctl_shared where ddp->params_length can be accessed/modified by multiple threads without proper locking, enabling race conditions. If ddp->...

CVE-2017-8250

CVE-2017-8250 (Qualcomm GPU driver, Android CAF builds) affects Qualcomm GPU driver in Android CAF using the Linux kernel. The vulnerability arises when user-controlled variables nr_cmds and nr_bos are passed between functions without checks, allowing an integer overflow that can overflow a small...

CVE-2017-9725

CVE-2017-9725 affects Qualcomm CAF Android builds using the Linux kernel. Root cause: during DMA allocation, a wrong data type of size truncates the allocation size, causing it to succeed when it should fail. This yields a high-severity issue (local access, low attack complexity) as reflected in ...

CVE-2017-8251

CVE-2017-8251 affects Qualcomm camera driver components in Android CAF builds on Linux kernels. The bug arises when msm_isp_check_stream_cfg_cmd and msm_isp_stats_update_cgc_override fail to validate stream_cfg_cmd->num_streams, allowing an overflow of stream_cfg_cmd->stream_handle. The CVE...

CVE-2017-9720

CVE-2017-9720 affects Qualcomm camera driver in Android CAF Linux kernel builds, where an off-by-one error can trigger an out-of-bounds read/write. The vulnerability is listed under Qualcomm components as an Elevation of Privilege (EoP) risk with the camera driver as the affected component; expli...

CVE-2017-10999

CVE-2017-10999 concerns the Qualcomm IPA (IP Multimedia Architecture) driver in Android CAF builds on the Linux kernel. The issue arises when concurrent calls into RMNET_IOCTL_ADD_MUX_CHANNEL in the IPA WAN driver may lead to memory corruption due to missing synchronization locks. The vulnerabili...

CVE-2017-11001

In all Qualcomm products with Android releases from CAF using the Linux kernel, the length of the MAC address is not checked which may cause out of bounds read...

CVE-2017-8280

In all Qualcomm products with Android releases from CAF using the Linux kernel, during the wlan calibration data store and retrieve operation, there are some potential race conditions which lead to a memory leak and a buffer overflow during the context switch...

CVE-2017-8278

In all Qualcomm products with Android releases from CAF using the Linux kernel, while reading audio data from an unspecified driver, a buffer overflow or integer overflow could occur...

CVE-2017-11000

In all Qualcomm products with Android releases from CAF using the Linux kernel, in an ISP Camera kernel driver function, an incorrect bounds check may potentially lead to an out-of-bounds write...

CVE-2017-10996

CVE-2017-10996 affects Qualcomm devices running CAF Android builds that use the Linux kernel. The vulnerability is an out-of-bounds access in c_show() caused by compat_hwcap_str[] not being NULL-terminated. The issue could cause device crashes/reboots (memory violation/out-of-bounds access). The ...

CVE-2017-10998

CVE-2017-10998 : In Qualcomm’s audio driver used on Android CAF builds, the function audio_aio_ion_lookup_vaddr uses a user-provided buffer length to validate the region. If length is large, the address+length check can overflow, yielding a result well below the valid region. This can lead to out...

CVE-2017-8277

In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function msmdbaregisterclient, if the client registers failed, it would be freed. However the client was not removed from list. Use-after-free would occur when traversing the list next time...

CVE-2017-9725

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

CVE-2017-9676

In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing global static variables without using a lock...

CVE-2017-9677

In all Qualcomm products with Android releases from CAF using the Linux kernel, in function msmcomprioctlshared, variable "ddp-paramslength" could be accessed and modified by multiple threads, while it is not protected with locks. If one thread is running, while another thread is setting data, ra...

CVE-2017-11001

CVE-2017-11001 affects Qualcomm components: Wi-Fi driver in Android CAF/Linux kernel. The root cause is an unchecked MAC address length, which may cause an out-of-bounds read. This can lead to a potential information disclosure (confidentiality impact Partial). CVSS details in the provided record...

CVE-2017-11000

CVE-2017-11000 affects Qualcomm components: specifically the Camera driver within Android CAF builds using the Linux kernel ISP Camera driver function. The root cause is an incorrect bounds check that may lead to an out-of-bounds write, described as an Elevation of Privilege (EoP) issue in the Qu...