qualcomm / fastconnect_6800 CVEs

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.

Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.

Memory corruption while running VK synchronization with KASAN enabled.

Transient DOS in WLAN Firmware while parsing a BTM request.

Transient DOS in Data Modem during DTLS handshake.

Memory corruption while receiving a message in Bus Socket Transport Server.

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.

Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Transient DOS while parsing WPA IES, when it is passed with length more than expected size.

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.

Transient DOS when processing a NULL buffer while parsing WLAN vdev.

Memory corruption when processing cmd parameters while parsing vdev.

Transient DOS in Bluetooth Host while rfc slot allocation.

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

Memory Corruption in Audio while invoking IOCTLs calls from the user-space.

Memory Corruption in camera while installing a fd for a particular DMA buffer.

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.

Memory corruption while processing audio effects.

Information disclosure in WLAN HAL while handling command through WMI interfaces.

Information disclosure in WLAN HAL when reception status handler is called.

Information disclosure in WLAN HAL while handling the WMI state info command.