Wcd9370 Firmware Security Vulnerabilities

CVE-2023-43554

Memory corruption while processing IOCTL handler in FastRPC.

CVE-2024-21461

Memory corruption while performing finish HMAC operation when context is freed by keymaster.

CVE-2024-21462

Transient DOS while loading the TA ELF file.

CVE-2024-21465

Memory corruption while processing key blob passed by the user.

CVE-2024-21469

Memory corruption when an invoke call and a TEE call are bound for the same trusted application.

CVE-2024-23368

Memory corruption when allocating and accessing an entry in an SMEM partition.

CVE-2024-23372

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.

CVE-2024-23373

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.

CVE-2024-23380

Memory corruption while handling user packets during VBO bind operation.

CVE-2024-33038

Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.

CVE-2024-33042

Memory corruption when Alternative Frequency offset value is set to 255.

CVE-2024-33045

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

CVE-2024-33047

Memory corruption when the captureRead QDCM command is invoked from user-space.

CVE-2024-33048

Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.

CVE-2024-33050

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.

CVE-2024-33051

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.

CVE-2024-33052

Memory corruption when user provides data for FM HCI command control operations.

CVE-2024-33054

Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.

CVE-2024-33057

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

CVE-2024-33060

Memory corruption when two threads try to map and unmap a single node simultaneously.

CVE-2024-38401

Memory corruption while processing concurrent IOCTL calls.

CVE-2024-38402

Memory corruption while processing IOCTL call for getting group info.