59 matches found
CVE-2024-43047
Memory corruption while maintaining memory maps of HLOS memory.
CVE-2025-21424
Memory corruption while calling the NPU driver APIs concurrently.
CVE-2025-21467
Memory corruption while reading the FW response from the shared queue.
CVE-2023-22387
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
CVE-2023-24851
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
CVE-2023-28541
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
CVE-2023-28542
Memory Corruption in WLAN HOST while fetching TX status information.
CVE-2023-33115
Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.
CVE-2023-22386
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
CVE-2023-28577
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.
CVE-2024-21475
Memory corruption when the payload received from firmware is not as per the expected protocol size.
CVE-2023-24854
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
CVE-2024-53027
Transient DOS may occur while processing the country IE.
CVE-2024-33042
Memory corruption when Alternative Frequency offset value is set to 255.
CVE-2025-21453
Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.
CVE-2023-33101
Transient DOS while processing DL NAS TRANSPORT message with payload length 0.
CVE-2024-33052
Memory corruption when user provides data for FM HCI command control operations.
CVE-2023-28575
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
CVE-2023-43521
Memory corruption when multiple listeners are being registered with the same file descriptor.
CVE-2024-53014
Memory corruption may occur while validating ports and channels in Audio driver.
CVE-2023-28567
Memory corruption in WLAN HAL while handling command through WMI interfaces.
CVE-2023-33099
Transient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.
CVE-2024-49835
Memory corruption while reading secure file.
CVE-2023-21637
Memory corruption in Linux while calling system configuration APIs.
CVE-2023-28576
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to ou...
CVE-2023-33086
Transient DOS while processing multiple IKEV2 Informational Request to device from IPSEC server with different identifiers.
CVE-2023-33095
Transient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.
CVE-2023-43539
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
CVE-2023-33096
Transient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.
CVE-2023-33104
Transient DOS while processing PDU Release command with a parameter PDU ID out of range.
CVE-2023-33015
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
CVE-2023-28573
Memory corruption in WLAN HAL while parsing WMI command parameters.
CVE-2024-49845
Memory corruption during the FRS UDS generation process.
CVE-2023-21638
Memory corruption in Video while calling APIs with different instance ID than the one received in initialization.
CVE-2024-45564
Memory corruption during concurrent access to server info object due to incorrect reference count update.
CVE-2023-21633
Memory Corruption in Linux while processing QcRilRequestImsRegisterMultiIdentityMessage request.
CVE-2023-21635
Memory Corruption in Data Network Stack & Connectivity when sim gets detected on telephony.
CVE-2024-45562
Memory corruption during concurrent access to server info object due to unprotected critical field.
CVE-2024-49844
Memory corruption while triggering commands in the PlayReady Trusted application.
CVE-2024-21476
Memory corruption when the channel ID passed by user is not validated and further used.
CVE-2024-33051
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
CVE-2024-45570
Memory corruption may occur during IO configuration processing when the IO port count is invalid.
CVE-2024-49842
Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.
CVE-2024-45566
Memory corruption during concurrent buffer access due to modification of the reference count.
CVE-2024-49841
Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.
CVE-2023-43542
Memory corruption while copying a keyblobs material when the key materials size is not accurately checked.
CVE-2024-38418
Memory corruption while parsing the memory map info in IOCTL calls.
CVE-2023-43530
Memory corruption in HLOS while checking for the storage type.
CVE-2024-43057
Memory corruption while processing command in Glink linux.
CVE-2023-43529
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.