qualcomm / wcn6755 CVEs

Information Disclosure when processing wireless network channel switch information with improperly formatted length fields.

Memory corruption while processing a frame request from user.

Cryptographic issue may occur while encrypting license data.

Memory corruption during the FRS UDS generation process.

Transient DOS can occur while processing UCI command.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Transient DOS while processing the CU information from RNR IE.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Memory corruption while processing IOCTL calls to unmap the buffers.

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.

Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the…

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.