384 matches found
CVE-2024-23374
Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
CVE-2024-33051
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
CVE-2024-38410
Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.
CVE-2024-38413
Memory corruption while processing frame packets.
CVE-2024-45561
Memory corruption while handling IOCTL call from user-space to set latency level.
CVE-2024-45570
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
CVE-2024-49842
Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
CVE-2024-53034
Memory corruption occurs during an Escape call if an invalid Kernel Mode CPU event and sync object handle are passed with the DriverKnownEscape flag reset.
CVE-2023-43527
Information disclosure while parsing dts header atom in Video.
CVE-2024-33013
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
CVE-2024-33055
Memory corruption while invoking IOCTL calls to unmap the DMA buffers.
CVE-2024-38426
While processing the authentication message in UE, improper authentication may lead to information disclosure.
CVE-2024-43060
Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.
CVE-2024-43062
Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.
CVE-2024-45566
Memory corruption during concurrent buffer access due to modification of the reference count.
CVE-2024-49841
Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
CVE-2024-53011
Information disclosure may occur due to improper permission and access controls to Video Analytics engine.
CVE-2024-53033
Memory corruption while doing Escape call when user provides valid kernel address in the place of valid user buffer address.
CVE-2023-43528
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
CVE-2023-43542
Memory corruption while copying a keyblobs material when the key materials size is not accurately checked.
CVE-2024-23369
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
CVE-2024-33067
Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.
CVE-2024-33073
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
CVE-2024-38401
Memory corruption while processing concurrent IOCTL calls.
CVE-2024-38406
Memory corruption while handling IOCTL calls in JPEG Encoder driver.
CVE-2024-38412
Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.
CVE-2024-45550
Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls.
CVE-2024-45575
Memory corruption Camera kernel when large number of devices are attached through userspace.
CVE-2024-49829
Memory corruption can occur during context user dumps due to inadequate checks on buffer length.
CVE-2024-53023
Memory corruption may occur while accessing a variable during extended back to back tests.
CVE-2024-53025
Transient DOS can occur while processing UCI command.
CVE-2023-43531
Memory corruption while verifying the serialized header when the key pairs are generated.
CVE-2023-43538
Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.
CVE-2024-21460
Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.
CVE-2024-21462
Transient DOS while loading the TA ELF file.
CVE-2024-21474
Memory corruption when size of buffer from previous call is used without validation or re-initialization.
CVE-2024-23360
Memory corruption while creating a LPAC client as LPAC engine was allowed to access GPU registers.
CVE-2024-33026
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
CVE-2024-33034
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
CVE-2024-38404
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.
CVE-2024-38417
Information disclosure while processing IO control commands.
CVE-2024-38418
Memory corruption while parsing the memory map info in IOCTL calls.
CVE-2024-38420
Memory corruption while configuring a Hypervisor based input virtual device.
CVE-2024-43050
Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.
CVE-2024-45560
Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.
CVE-2024-45584
Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.
CVE-2023-43526
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
CVE-2024-21477
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
CVE-2024-23376
Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.
CVE-2024-23382
Memory corruption while processing graphics kernel driver request to create DMA fence.