qualcomm / qcs8550 CVEs

Memory corruption while processing identity credential operations in the trusted application.

Memory corruption while processing a config call from userspace.

Memory corruption while performing encryption and decryption commands.

Information disclosure while running video usecase having rogue firmware.

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.

Memory corruption when passing parameters to the Trusted Virtual Machine during the handshake.

Information disclosure while capturing logs as eSE debug messages are logged.

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Transient DOS may occur while parsing SSID in action frames.

Transient DOS may occur while parsing EHT operation IE or EHT capability IE.

Memory corruption in display driver while detaching a device.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Memory corruption while registering a buffer from user-space to kernel-space using IOCTL calls.

Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.

Memory corruption while processing frame command IOCTL calls.

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,

Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.

Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.

Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.

Memory corruption when malformed message payload is received from firmware.

Memory Corruption in Core while invoking a call to Access Control core library with hardware protected address range.

Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network.