qualcomm / qca6420_firmware CVEs

Memory Corruption when allocating memory with sizes that exceed the maximum allowed value.

Memory corruption in diagnostic services due to absence of input validation

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when multiple threads simultaneously access a memory free API.

Memory Corruption when processing IOCTLs for JPEG data without verification.

Memory corruption while encoding the image data.

Memory corruption due to double free when multiple threads race to set the timestamp store.

Memory corruption while processing simultaneous requests via escape path.

Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host.

Memory corruption during the image encoding process.

Memory corruption while processing event close when client process terminates abruptly.

Memory corruption while processing multiple simultaneous escape calls.

Memory corruption while processing a private escape command in an event trigger.

Memory corruption while processing escape code, when DisplayId is passed with large unsigned value.

Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter.

Memory corruption when IOCTL call is invoked from user-space to write board data to WLAN driver.

Memory corruption occurs when handling client calls to EnableTestMode through an Escape call.

Memory corruption while processing escape code in API.

Memory corruption while handling IOCTL call from user-space to set latency level.

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.

Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.

Memory corruption while processing IOCTL handler in FastRPC.

Information disclosure in Video while parsing mp2 clip with invalid section length.

Memory corruption when the channel ID passed by user is not validated and further used.