qualcomm sa8150p firmware vulnerabilities, newest first

Memory Corruption when handling malformed request parameters in the fingerprint TA.

Memory corruption while processing a packet with a size close to the maximum allowed value.

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Memory corruption while processing a secure logging command in the trusted application.

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption during video playback when video session open fails with time out error.

Memory corruption while processing large input data from a remote source via a communication interface.

Information disclosure while processing message from client with invalid payload.

Memory corruption while processing client message during device management.

Memory corruption while processing control commands in the virtual memory management interface.

Transient DOS while processing video packets received from video firmware.

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

information disclosure while invoking calibration data from user space to update firmware size.

Information disclosure while processing a packet at EAVB BE side with invalid header length.

Memory corruption while processing commands from A2dp sink command queue.

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Transient DOS while processing received beacon frame.

Transient DOS may occur while processing malformed length field in SSID IEs.

Memory corruption may occur while processing voice call registration with user.

Memory corruption while reading the FW response from the shared queue.

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

Memory corruption while sound model registration for voice activation with audio kernel driver.

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

Memory corruption during concurrent access to server info object due to incorrect reference count update.

Memory corruption during concurrent access to server info object due to unprotected critical field.

Memory corruption while processing message content in eAVB.

Information disclosure may be there when a guest VM is connected.

Memory corruption may occur due top improper access control in HAB process.

Memory corruption while processing IOCTL calls to add route entry in the HW.

Memory corruption while accessing MSM channel map and mixer functions.

Memory corruption while invoking IOCTL map buffer request from userspace.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Memory corruption while handling file descriptor during listener registration/de-registration.

Memory corruption while processing input message passed from FE driver.

Memory corruption may occur while processing message from frontend during allocation.

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is empty in HLOS drive.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.

Memory corruption while parsing the memory map info in IOCTL calls.

Information disclosure while processing IO control commands.

Information disclosure during audio playback.

Information disclosure while processing information on firmware image during core initialization.

Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system imag…

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver.

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,

Memory corruption when multiple threads try to unregister the CVP buffer at the same time.

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware.

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to huge allocation or invalid memory access.