qualcomm / qca9367_firmware CVEs

Memory corruption when dynamically changing the size of a previously allocated buffer while its contents are being modified.

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

Transient DOS while parsing video packets received from the video firmware.

information disclosure while invoking calibration data from user space to update firmware size.

Information disclosure while capturing logs as eSE debug messages are logged.

Memory corruption while processing an IOCTL call to set mixer controls.

Memory corruption while sound model registration for voice activation with audio kernel driver.

Memory corruption while processing IOCTL calls to add route entry in the HW.

Transient DOS may occur while processing the country IE.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.

Information disclosure while processing IO control commands.

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.

Improper integrity check can lead to race condition between tasks PDCP and RRC? right after a valid RRC security mode command packet has been received in Snapdragon Industrial IOT

Possible buffer over-read due to lack of length check while flashing meta images in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music…

Possible buffer over-read due to incorrect overflow check when loading splash image in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Mu…

Possible Buffer Over-read due to lack of validation of boundary checks when loading splash image in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdrag…

Integer overflow in boot due to improper length check on arguments received in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music