qualcomm / wcd9395 CVEs

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.

Cryptographic issue while copying data to a destination buffer without validating its size.

Cryptographic issue may occur while encrypting license data.

Memory corruption while performing sensor register read operations.

Cryptographic issue occurs due to use of insecure connection method while downloading.

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.

Memory corruption during the FRS UDS generation process.

Memory corruption while handling multiple IOCTL calls from userspace to operate DMA operations.

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.

Transient DOS can occur while processing UCI command.

Memory corruption while processing frame packets.

Memory corruption while invoking IOCTL calls from user-space to kernel-space to handle session errors.

Memory corruption while processing IPA statistics, when there are no active clients registered.

Transient DOS while processing the CU information from RNR IE.

Memory corruption while processing IOCTL calls to unmap the buffers.

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Transient DOS while parsing probe response and assoc response frame.

Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.

Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.

Memory corruption when kernel driver attempts to trigger hardware fences.

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.

Memory corruption when keymaster operation imports a shared key.

Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs t…

Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile