qualcomm sa8295p firmware vulnerabilities, newest first

Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying.

Memory Corruption while processing IOCTL device driver requests with invalid arguments.

Memory Corruption when handling malformed request parameters in the fingerprint TA.

Memory corruption while processing a packet with a size close to the maximum allowed value.

Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification.

Memory Corruption when accessing trusted execution environment without proper privilege check.

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Memory corruption while processing a secure logging command in the trusted application.

Cryptographic issue may occur while encrypting license data.

Memory corruption while loading an invalid firmware in boot loader.

Memory corruption during video playback when video session open fails with time out error.

Memory corruption while processing large input data from a remote source via a communication interface.

Information disclosure while processing message from client with invalid payload.

Memory corruption when triggering a subsystem crash with an out-of-range identifier.

Memory corruption while processing client message during device management.

Memory corruption while processing control commands in the virtual memory management interface.

Memory corruption while handling repeated memory unmap requests from guest VM.

Memory corruption while processing data sent by FE driver.

Memory corruption while processing message in guest VM.

Memory corruption while processing config_dev IOCTL when camera kernel driver drops its reference to CPU buffers.

information disclosure while invoking calibration data from user space to update firmware size.

Information disclosure while processing a packet at EAVB BE side with invalid header length.

Memory corruption while processing commands from A2dp sink command queue.

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Transient DOS while processing received beacon frame.

Transient DOS may occur while processing malformed length field in SSID IEs.

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.

Memory corruption while copying the result to the transmission queue in EMAC.

Memory corruption may occur while processing voice call registration with user.

Memory corruption while reading the FW response from the shared queue.

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

Memory corruption while sound model registration for voice activation with audio kernel driver.

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

Memory corruption during concurrent access to server info object due to incorrect reference count update.

Memory corruption during concurrent access to server info object due to unprotected critical field.

Memory corruption while processing message content in eAVB.

Memory corruption while transmitting packet mapping information with invalid header payload size.

Memory corruption while processing memory map or unmap IOCTL operations simultaneously.

Information disclosure may be there when a guest VM is connected.

Memory corruption may occur due top improper access control in HAB process.

Memory corruption while accessing MSM channel map and mixer functions.

Memory corruption while invoking IOCTL map buffer request from userspace.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Memory corruption while handling file descriptor during listener registration/de-registration.

Memory corruption may occur in keyboard virtual device due to guest VM interaction.

Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine.

Memory corruption while processing input message passed from FE driver.

Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine.

Memory corruption may occur while processing message from frontend during allocation.