qualcomm / sa7775p CVEs

Memory Corruption when copying data from a freed source while executing performance counter deselect operation.

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

Memory corruption when accessing resources in kernel driver.

Memory corruption while processing shared command buffer packet between camera userspace and kernel.

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption while processing request sent from GVM.

Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously.

Transient DOS may occur while parsing EHT operation IE or EHT capability IE.

Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine.

Memory corruption may occur during communication between primary and guest VM.

Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.

Memory corruption while releasing shared resources in MinkSocket listener thread.