qualcomm / qcm8550 CVEs

Memory corruption while accessing a synchronization object during concurrent operations.

Memory corruption while processing a config call from userspace.

Information disclosure while running video usecase having rogue firmware.

Information disclosure while reading data from an image using specified offset and size parameters.

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.

Transient DOS may occur while processing the country IE.

Memory corruption while validating number of devices in Camera kernel .

Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.

Memory corruption while processing frame command IOCTL calls.

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,

Memory corruption when invalid input is passed to invoke GPU Headroom API call.

Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.

Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.

Transient DOS while processing DL NAS Transport message when message ID is not defined in the 3GPP specification.

Transient DOS while processing CAG info IE received from NW.

Transient DOS while processing IE fragments from server during DTLS handshake.

Memory corruption in Data Modem while verifying hello-verify message during the DTLS handshake.

Memory corruption when malformed message payload is received from firmware.

Transient DOS in Core when DDR memory check is called while DDR is not initialized.

Information disclosure in Modem while processing SIB5.

Memory corruption in Modem while processing security related configuration before AS Security Exchange.