qualcomm / sxr2250p CVEs

Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

Memory corruption may occur while processing IOCTL call for DMM/WARPNCC CONFIG request.

Memory corruption during dynamic process creation call when client is only passing address and length of shell binary.

Memory corruption while processing INIT and multimode invoke IOCTL calls on FastRPC.

Memory corruption may occur while processing the OIS packet parser.

Memory corruption while acquire and update IOCTLs during IFE output resource ID validation.

Memory corruption while prociesing command buffer buffer in OPE module.

Memory corruption Camera kernel when large number of devices are attached through userspace.

Memory corruption due to improper bounds check while command handling in camera-kernel driver.

Memory corruption while encoding JPEG format.

Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding session.

Memory corruption during concurrent SSR execution due to race condition on the global maps list.

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline.

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Memory corruption while processing camera use case IOCTL call.