CVE-2017-9720

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to an off-by-one error in a camera driver, an out-of-bounds read/write can occur...

Code injection

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

CVE-2017-9676

In all Qualcomm products with Android releases from CAF using the Linux kernel, potential use after free scenarios and race conditions can occur when accessing global static variables without using a lock...

Race condition

In all Qualcomm products with Android releases from CAF using the Linux kernel, in function msmcomprioctlshared, variable "ddp-paramslength" could be accessed and modified by multiple threads, while it is not protected with locks. If one thread is running, while another thread is setting data, ra...

CVE-2017-9725

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

CVE-2017-10999

In all Qualcomm products with Android releases from CAF using the Linux kernel, concurrent calls into ioctl RMNETIOCTLADDMUXCHANNEL in ipa wan driver may lead to memory corruption due to missing locks...

CVE-2017-10999

CVE-2017-10999 concerns the Qualcomm IPA (IP Multimedia Architecture) driver in Android CAF builds on the Linux kernel. The issue arises when concurrent calls into RMNET_IOCTL_ADD_MUX_CHANNEL in the IPA WAN driver may lead to memory corruption due to missing synchronization locks. The vulnerabili...

CVE-2017-10996

CVE-2017-10996 affects Qualcomm devices running CAF Android builds that use the Linux kernel. The vulnerability is an out-of-bounds access in c_show() caused by compat_hwcap_str[] not being NULL-terminated. The issue could cause device crashes/reboots (memory violation/out-of-bounds access). The ...

CVE-2017-9725

In all Qualcomm products with Android releases from CAF using the Linux kernel, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail...

CVE-2017-8250

CVE-2017-8250 (Qualcomm GPU driver, Android CAF builds) affects Qualcomm GPU driver in Android CAF using the Linux kernel. The vulnerability arises when user-controlled variables nr_cmds and nr_bos are passed between functions without checks, allowing an integer overflow that can overflow a small...

CVE-2017-10997

In all Qualcomm products with Android releases from CAF using the Linux kernel, using a debugfs node, a write to a PCIe register can cause corruption of kernel memory...

CVE-2017-8277

In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function msmdbaregisterclient, if the client registers failed, it would be freed. However the client was not removed from list. Use-after-free would occur when traversing the list next time...

CVE-2017-8277

In CVE-2017-8277, Qualcomm products running Android CAF builds on the Linux kernel are affected. The issue occurs in the function msm_dba_register_client: if a client’s registration fails, the object is freed but not removed from the list, enabling a use-after-free when the list is traversed next...

CVE-2017-11001

In all Qualcomm products with Android releases from CAF using the Linux kernel, the length of the MAC address is not checked which may cause out of bounds read...

CVE-2017-11000

In all Qualcomm products with Android releases from CAF using the Linux kernel, in an ISP Camera kernel driver function, an incorrect bounds check may potentially lead to an out-of-bounds write...

CVE-2017-8280

In all Qualcomm products with Android releases from CAF using the Linux kernel, during the wlan calibration data store and retrieve operation, there are some potential race conditions which lead to a memory leak and a buffer overflow during the context switch...

CVE-2017-10998

In all Qualcomm products with Android releases from CAF using the Linux kernel, in audioaioionlookupvaddr, the buffer length, which is user input, ends up being used to validate if the buffer is fully within the valid region. If the buffer length is large enough then the address + length operatio...

CVE-2017-9677

CVE-2017-9677 affects Qualcomm components, specifically the Audio driver, in CAF Android builds using the Linux kernel. The issue arises in msm_compr_ioctl_shared where ddp->params_length can be accessed/modified by multiple threads without proper locking, enabling race conditions. If ddp->...

CVE-2017-9725

CVE-2017-9725 affects Qualcomm CAF Android builds using the Linux kernel. Root cause: during DMA allocation, a wrong data type of size truncates the allocation size, causing it to succeed when it should fail. This yields a high-severity issue (local access, low attack complexity) as reflected in ...

CVE-2017-8250

In all Qualcomm products with Android releases from CAF using the Linux kernel, user controlled variables "nrcmds" and "nrbos" number are passed across functions without any check. An integer overflow to buffer overflow with a smaller buffer allocated may occur when they are too large or negative...