qualcomm / qca6391_firmware CVEs

Memory Corruption when processing registry values with incorrect types using a direct query method.

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.

Memory corruption while using Strongbox due to buffer overflow.

Memory corruption while using Strongbox due to missing bounds check.

Memory Corruption when processing display command line information due to improper initialization of a variable.

Memory corruption in diagnostic services due to absence of input validation

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Transient DOS when MAC configures config id greater than supported maximum value.

Cryptographic Issue when a shared VM reference allows HLOS to boot loader and access cert chain.

Memory Corruption when multiple threads simultaneously access a memory free API.

Memory corruption while accessing a synchronization object during concurrent operations.

Memory Corruption when processing IOCTLs for JPEG data without verification.

Memory corruption while routing GPR packets between user and root when handling large data packet.

Memory corruption while encoding the image data.

Memory corruption due to double free when multiple threads race to set the timestamp store.

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

Memory corruption while selecting the PLMN from SOR failed list.

Memory corruption while processing simultaneous requests via escape path.

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

Memory corruption while processing specific files in Powerline Communication Firmware.

Transient DOS while processing CCCH data when NW sends data with invalid length.

Memory corruption while processing commands from A2dp sink command queue.

Memory corruption while submitting blob data to kernel space though IOCTL.

Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network.

Memory corruption during the image encoding process.