qualcomm sa6155p firmware vulnerabilities, newest first

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.

Memory Corruption when handling malformed request parameters in the fingerprint TA.

Memory corruption while processing a packet with a size close to the maximum allowed value.

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.

Memory Corruption when accessing trusted execution environment without proper privilege check.

Memory Corruption while processing IOCTL calls when concurrent access to shared buffer occurs.

Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Memory corruption while processing a secure logging command in the trusted application.

Memory corruption while handling sensor utility operations.

Memory corruption while loading an invalid firmware in boot loader.

Memory corruption while copying packets received from unix clients.

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption during video playback when video session open fails with time out error.

Memory corruption while processing large input data from a remote source via a communication interface.

Information disclosure while processing message from client with invalid payload.

Memory corruption while processing client message during device management.

Memory corruption while processing control commands in the virtual memory management interface.

Transient DOS while processing video packets received from video firmware.

Memory corruption while handling invalid inputs in application info setup.

Memory corruption while processing data sent by FE driver.

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

information disclosure while invoking calibration data from user space to update firmware size.

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.

Information disclosure while processing a packet at EAVB BE side with invalid header length.

Memory corruption while processing commands from A2dp sink command queue.

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Transient DOS while processing received beacon frame.

Transient DOS may occur while processing malformed length field in SSID IEs.

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

Memory corruption while processing IOCTL command to handle buffers associated with a session.

Memory corruption may occur while processing voice call registration with user.

Memory corruption while reading the FW response from the shared queue.

Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit.

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

Memory corruption while sound model registration for voice activation with audio kernel driver.

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

Memory corruption during concurrent access to server info object due to incorrect reference count update.

Memory corruption during concurrent access to server info object due to unprotected critical field.

Memory corruption while processing message content in eAVB.

Memory corruption while processing memory map or unmap IOCTL operations simultaneously.

Information disclosure may be there when a guest VM is connected.

Memory corruption may occur due top improper access control in HAB process.

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.

Memory corruption while processing IOCTL calls to add route entry in the HW.

Memory corruption while accessing MSM channel map and mixer functions.

Memory corruption while invoking IOCTL map buffer request from userspace.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Memory corruption while handling file descriptor during listener registration/de-registration.