qualcomm / wcd9370_firmware CVEs

Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length.

Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory corruption while preprocessing IOCTL request in JPEG driver.

Memory corruption while processing a video session to set video parameters.

Memory corruption while accessing a buffer during IOCTL processing.

Memory corruption while processing user buffers.

Information disclosure when Video engine escape input data is less than expected minimum size.

Memory corruption when programming registers through virtual CDM.

Memory corruption while processing the TESTPATTERNCONFIG escape path.

memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.

Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call.

Memory corruption while processing IPA statistics, when there are no active clients registered.

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while station LL statistic handling.

Memory corruption while handling IOCTL calls in JPEG Encoder driver.

Memory corruption while processing user packets to generate page faults.

Transient DOS while parsing probe response and assoc response frame.

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.

Information disclosure while handling beacon or probe response frame in STA.

Transient DOS while decoding message of size that exceeds the available system memory.

Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.