qualcomm / qca6584au_firmware CVEs

Memory Corruption when processing display command line information due to improper initialization of a variable.

Information disclosure while processing message from client with invalid payload.

Transient DOS while processing video packets received from video firmware.

Transient DOS while parsing the EPTM test control message to get the test pattern.

Memory corruption while selecting the PLMN from SOR failed list.

information disclosure while invoking calibration data from user space to update firmware size.

Transient DOS while processing CCCH data when NW sends data with invalid length.

Information disclosure while opening a fastrpc session when domain is not sanitized.

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Transient DOS while processing the EHT operation IE in the received beacon frame.

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

Transient DOS may occur while parsing extended IE in beacon.

Memory corruption while processing multiple IOCTL calls from HLOS to DSP.

Memory corruption can occur when TME processes addresses from TZ and MPSS requests without proper validation.

Memory corruption while processing input message passed from FE driver.

Information disclosure while processing IO control commands.

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.

Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive…

Memory corruption while handling the PDR in driver for getting the remote heap maps.

Memory corruption while maintaining memory maps of HLOS memory.

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.

Memory corruption while processing concurrent IOCTL calls.

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.

Memory corruption when more scan frequency list or channels are sent from the user space.