qualcomm / sw5100_firmware CVEs

Memory corruption while processing MFC channel configuration during music playback.

Memory corruption while allocating buffers in DSP service.

Memory corruption during sub-system restart while processing clean-up to free up resources.

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.

Memory corruption may occur while processing the OIS packet parser.

Memory corruption while prociesing command buffer buffer in OPE module.

Memory corruption during concurrent SSR execution due to race condition on the global maps list.

Memory corruption may occur while initiating two IOCTL calls simultaneously to create processes from two different threads.

Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.

Memory corruption during the network scan request.

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.

Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.

Information disclosure while handling beacon probe frame during scan entry generation in client side.

Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.

Memory corruption due to improper validation of array index in Audio.

Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.

Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.

Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables

Disabled SMMU from secure side while RPM is assigned a secure stream can lead to information disclosure in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrast…

RPM secure Stream can access any secure resource due to improper SMMU configuration in Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrast…