qualcomm sa8650p firmware vulnerabilities, newest first

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Memory corruption when accessing resources in kernel driver.

Cryptographic issue may occur while encrypting license data.

Memory corruption while processing shared command buffer packet between camera userspace and kernel.

Memory corruption while loading an invalid firmware in boot loader.

Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication.

Memory corruption while copying packets received from unix clients.

Memory corruption while processing large input data from a remote source via a communication interface.

Information disclosure while processing message from client with invalid payload.

Memory corruption when triggering a subsystem crash with an out-of-range identifier.

Memory corruption while processing client message during device management.

Information Disclosure when a user-level driver performs QFPROM read or write operations on Fuse regions.

Memory corruption while processing request sent from GVM.

Memory corruption while processing control commands in the virtual memory management interface.

Memory corruption while handling repeated memory unmap requests from guest VM.

Memory corruption while processing data sent by FE driver.

Memory corruption while processing message in guest VM.

Information disclosure while processing a packet at EAVB BE side with invalid header length.

Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously.

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Transient DOS while processing received beacon frame.

Transient DOS may occur while processing malformed length field in SSID IEs.

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.

Memory corruption while copying the result to the transmission queue in EMAC.

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

Memory corruption while processing message content in eAVB.

Memory corruption while transmitting packet mapping information with invalid header payload size.

Memory corruption while processing memory map or unmap IOCTL operations simultaneously.

Information disclosure may be there when a guest VM is connected.

Memory corruption may occur due top improper access control in HAB process.

Memory corruption may occur in keyboard virtual device due to guest VM interaction.

Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine.

Memory corruption while processing input message passed from FE driver.

Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine.

Memory corruption may occur while processing message from frontend during allocation.

Memory corruption may occur during communication between primary and guest VM.

Memory corruption may occur due to improper input validation in clock device.

Memory corruption while reading CPU state data during guest VM suspend.

Memory corruption while power-up or power-down sequence of the camera sensor.

Memory corruption can occur in the camera when an invalid CID is used.

Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.

Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorized programs to be injected into security-sensitive images, enabling the booting of a tampered IFS2 system imag…

Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU.

information disclosure while invoking the mailbox read API.

Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.

Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service.

Memory corruption during GNSS HAL process initialization.

Memory corruption while processing GPU commands.

Transient DOS while parsing BTM ML IE when per STA profile is not included.