qualcomm / sa6150p_firmware CVEs

Memory Corruption when handling malformed request parameters in the fingerprint TA.

Memory Corruption when copying data from a freed source while executing performance counter deselect operation.

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

Memory corruption may occur while processing voice call registration with user.

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur.

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.

Information disclosure while processing information on firmware image during core initialization.

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.

Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.

Memory corruption in Automotive Display while destroying the image handle created using connected display driver.

Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ).

Transient DOS in Bluetooth HOST while passing descriptor to validate the blacklisted BT keyboard.

Memory Corruption while accessing metadata in Display.

Memory corruption in Audio while validating and mapping metadata.

Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.

Memory corruption in RIL while trying to send apdu packet.

Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.

An app with non-privileged access can change global system brightness and cause undesired system behavior.