qualcomm / qmp1000_firmware CVEs

Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size.

Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling.

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input.

Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory.

Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization.

Memory corruption while processing fastboot commands with invalid input.

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.

Memory corruption occurs when a secure application is launched on a device with insufficient memory.

Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.

Memory corruption while passing pages to DSP with an unaligned starting address.

Memory corruption while parsing clock configuration data for a specific hardware type.

Memory corruption while processing a config call from userspace.

Memory corruption while allocating buffers in DSP service.

Memory corruption due to global buffer overflow when a test command uses an invalid payload type.

Memory corruption during sub-system restart while processing clean-up to free up resources.

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.

Transient DOS may occur while parsing EHT operation IE or EHT capability IE.

Memory corruption in display driver while detaching a device.

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline.

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.