qualcomm sa6145p firmware vulnerabilities, newest first, page 2

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.

Possible out of bound access in audio module due to lack of validation of user provided input.

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.

Memory corruption while maintaining memory maps of HLOS memory.

Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.

Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.

Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.

Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.

Transient DOS during music playback of ALAC content.

Information disclosure in Video while parsing mp2 clip with invalid section length.

Memory corruption while playing audio file having large-sized input buffer.

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.

Information disclosure while parsing dts header atom in Video.

Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.

Memory corruption while copying the sound model data from user to kernel buffer during sound model register.

Memory corruption when the bandpass filter order received from AHAL is not within the expected range.

Memory corruption when multiple listeners are being registered with the same file descriptor.

Memory corruption while processing Codec2 during v13k decoder pitch synthesis.

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.

Memory corruption while parsing qcp clip with invalid chunk data size.

Transient DOS while processing channel information for speaker protection v2 module in ADSP.

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.

Memory corruption in video while parsing invalid mp2 clip.

Memory corruption in HLOS while converting from authorization token to HIDL vector.

Memory corruption in Audio while processing the calibration data returned from ACDB loader.

Memory corruption in Audio while processing IIR config data from AFE calibration block.

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.

Information disclosure in Audio while accessing AVCS services from ADSP payload.

Transient DOS in Audio when invoking callback function of ASM driver.

Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.

Memory corruption while running VK synchronization with KASAN enabled.

Memory corruption in wearables while processing data from AON.

Transient DOS in Data Modem during DTLS handshake.

Memory corruption while receiving a message in Bus Socket Transport Server.

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.

Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.

Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.

Transient DOS in Automotive OS due to improper authentication to the secure IO calls.

Memory corruption while sending SMS from AP firmware.

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.

Memory Corruption in camera while installing a fd for a particular DMA buffer.

Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.

Memory corruption in Audio when SSR event is triggered after music playback is stopped.

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.

Memory corruption while processing audio effects.

Information disclosure in WLAN HAL while handling the WMI state info command.