qualcomm / csra6640_firmware CVEs

Cryptographic Issue while processing registration requests with malformed or missing authentication parameters.

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.

Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

Memory Corruption when processing fastboot commands to set display mode.

Memory corruption while processing fastboot commands with improperly formatted input.

Memory Corruption when processing device identifier strings that exceed the expected maximum length.

Memory corruption when decoding corrupted satellite data files with invalid signature offsets.

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.

Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.

Memory Corruption when concurrent access to shared buffer occurs during IOCTL calls.

Transient DOS when an LTE RLC packet with invalid TB is received by UE.

Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID.

Memory corruption while processing identity credential operations in the trusted application.

Memory corruption while processing shared command buffer packet between camera userspace and kernel.

Information disclosure while processing a firmware event.

Memory corruption while handling IOCTL calls to set mode.

Memory corruption while copying packets received from unix clients.

Memory corruption during video playback when video session open fails with time out error.

Memory corruption while processing video packets received from video firmware.

Memory corruption while retrieving the CBOR data from TA.

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.

Memory corruption while reading the FW response from the shared queue.

Memory corruption while reading secure file.

There may be information disclosure during memory re-allocation in TZ Secure OS.