Vulnerability of functions cs_dsp_coeff_parse_string(), cs_dsp_coeff_parse_int(), cs_dsp_coeff_parse_coeff(), and cs_dspParse_coeff() (drivers/firmware/cirrus/cs_dsp.c) in the Linux operating system’s kernel, which allows a hacker to cause a service failure.

The vulnerability of the functions csdspcoeffparsestring, csdspcoeffparseint, csdspcoeffparsecoeff, and csdspParsecoeff drivers/firmware/cirrus/csdsp.c in the Linux operating system’s kernel is related to the execution of operations outside of memory buffers. Exploiting this vulnerability can all...

CVE-2021-35077

Possible use after free scenario in compute offloads to DSP while multiple calls spawn a dynamic process in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2021-35132

Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables...

CVE-2021-35126

Memory corruption in DSP service due to improper validation of input parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2022-27813

Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memory protection units, MPU1 and MPU2, to enforce the trust boundary between the two cores. Since both units are left unconfigured by the...

CVE-2024-33038

Memory corruption while passing untrusted/corrupted pointers from DSP to EVA...

CVE-2024-45553 Use After Free in DSP Services

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise...

CVE-2024-45553

CVE-2024-45553 describes a memory corruption vulnerability in Qualcomm components where process-specific maps are added to a global list. The issue can manifest if a map is removed from the global list while another thread is using it for a process-specific task. The canonical description across ...

CVE-2024-45550

CVE-2024-45550 involves memory corruption when an IOCTL-calling application executes all MCDM driver IOCTL calls on Qualcomm chipsets. The affected component is the MCDM driver IOCTL interface; root cause is memory corruption triggered by IOCTL invocation patterns. Reported impact includes high c...

CVE-2024-33061 Buffer Over-read in DSP Service

Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process...

CVE-2024-33061 Buffer Over-read in DSP Service

Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process...

CVE-2024-49848

creationtimestamp| type| source ---|---|--- 2024-12-16 05:11:23+00:00| seen| https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html 2024-12-16 16:32:28+00:00| seen| https://infosec.exchange/users/screaminggoat/statuses/113663459141722483 2024-12-16...

The Qualcomm DSP Driver - Unexpectedly Excavating an Exploit

Posted by Seth Jenkins, Google Project Zero This blog post provides a technical analysis of exploit artifacts provided to us by Google's Threat Analysis Group TAG from Amnesty International. Amnesty’s report on these exploits is available here. Thanks to both Amnesty International and Google's...

OESA-2024-2498 ffmpeg security update

FFmpeg is a complete and free Internet live audio and video broadcasting solution for Linux/Unix. It also includes a digital VCR. It can encode in real time in many formats including MPEG1 audio and video, MPEG4, h263, ac3, asf, avi, real, mjpeg, and flash. Security Fixes: FFmpeg n6.1.1 is Intege...

kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

A vulnerability was found in the Linux kernel in the csdsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an...

kernel: firmware: cs_dsp: Validate payload length before processing block

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...

The vulnerability of Geovision GV-VS12, GV-VS11, GV-DSP LPR V3, GVLX 4, and GVLX 4 IP video server microprogramming systems arises from the failure to eliminate special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of Geovision GV-VS12, GV-VS11, GV-DSP LPR V3, GVLX 4, and GVLX 4 microprogrammed software for IP video servers is related to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor ...

kernel: ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/csdspctl: Use privatefree for control cleanup Use the control privatefree callback to free the associated data block. This ensures that the memory won't leak, whatever way the control gets destroyed. The original...

kernel: firmware: cs_dsp: Validate payload length before processing block

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...

kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

A vulnerability was found in the Linux kernel in the csdsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an...