qualcomm / wcn6855 CVEs

Possible out of bound access in audio module due to lack of validation of user provided input.

Transient DOS in Modem while processing RRC reconfiguration message.

Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.

Information disclosure in Trusted Execution Environment due to buffer over-read while processing metadata verification requests.

Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in Snapdragon Mobile, Snapdragon Wearables

Memory corruption in i2c buses due to improper input validation while reading address configuration from i2c driver in Snapdragon Mobile, Snapdragon Wearables

Denial of service in Modem due to reachable assertion in Snapdragon Mobile

Denial of service in MODEM due to reachable assertion while processing configuration from network in Snapdragon Mobile

Denial of service in MODEM due to reachable assertion in Snapdragon Mobile

Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication with a compromised kernel. in Snapdragon Mobile

Memory corruption in BTHOST due to double free while music playback and calls over bluetooth headset in Snapdragon Mobile

Memory corruption in multimedia due to use after free during callback registration failure in Snapdragon Mobile

Memory corruption in graphics due to use-after-free in graphics dispatcher logic in Snapdragon Mobile

Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile

Memory corruption in graphics due to use-after-free while graphics profiling in Snapdragon Connectivity, Snapdragon Mobile

Possible address manipulation from APP-NS while APP-S is configuring an RG where it tries to merge the address ranges in Snapdragon Connectivity, Snapdragon Mobile

Improper checking of AP-S lock bit while verifying the secure resource group permissions can lead to non secure read and write access in Snapdragon Connectivity, Snapdragon Mobile

Improper serialization of message queue client registration can lead to race condition allowing multiple gunyah message clients to register with same label in Snapdragon Connectiv…

Possible out of bounds read due to improper typecasting while handling page fault for global memory in Snapdragon Connectivity, Snapdragon Mobile

Possible buffer overflow to improper validation of hash segment of file while allocating memory in Snapdragon Connectivity, Snapdragon Mobile

Possible buffer out of bound read can occur due to improper validation of TBTT count and length while parsing the beacon response in Snapdragon Compute, Snapdragon Connectivity, S…