qualcomm sa7255p firmware vulnerabilities, newest first, page 2

Memory corruption may occur while processing message from frontend during allocation.

Memory corruption may occur while accessing a variable during extended back to back tests.

Memory corruption may occur during communication between primary and guest VM.

Memory corruption may occur due to improper input validation in clock device.

Memory corruption while reading CPU state data during guest VM suspend.

Memory corruption while power-up or power-down sequence of the camera sensor.

Memory corruption can occur in the camera when an invalid CID is used.

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.

Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.

Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system imag…

Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.

Memory corruption during GNSS HAL process initialization.

Memory corruption while processing GPU commands.

Transient DOS while processing the CU information from RNR IE.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Memory corruption while processing user packets to generate page faults.

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.

Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.

Memory corruption while releasing shared resources in MinkSocket listener thread.

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.

Transient DOS while processing TID-to-link mapping IE elements.

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.

Memory corruption when kernel driver attempts to trigger hardware fences.

Memory corruption while processing graphics kernel driver request to create DMA fence.

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.

Transient DOS during music playback of ALAC content.

Memory corruption while handling user packets during VBO bind operation.

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.

Information disclosure while parsing sub-IE length during new IE generation.

Information Disclosure while parsing beacon frame in STA.

Memory corruption when the IOCTL call is interrupted by a signal.

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.

Memory corruption while playing audio file having large-sized input buffer.

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.

Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.

Memory corruption while copying the sound model data from user to kernel buffer during sound model register.

Memory corruption when the bandpass filter order received from AHAL is not within the expected range.

Memory corruption when multiple listeners are being registered with the same file descriptor.

Memory corruption while processing Codec2 during v13k decoder pitch synthesis.

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.