qualcomm / sa8255p CVEs

Memory corruption while handling different IOCTL calls from the user-space simultaneously.

Memory corruption when accessing resources in kernel driver.

Memory corruption while processing a secure logging command in the trusted application.

Memory corruption while processing shared command buffer packet between camera userspace and kernel.

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption while processing request sent from GVM.

Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously.

Memory corruption while triggering commands in the PlayReady Trusted application.

Memory corruption while reading secure file.

Memory corruption may occur in keyboard virtual device due to guest VM interaction.

Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine.

information disclosure while invoking the mailbox read API.

Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.

Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer acce…

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.

Memory corruption while releasing shared resources in MinkSocket listener thread.

transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA.

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.

Memory corruption in Automotive Multimedia due to improper access control in HAB.