qualcomm sa8650p firmware vulnerabilities, newest first, page 2

Memory corruption while processing user packets to generate page faults.

Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.

Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.

Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.

Memory corruption while releasing shared resources in MinkSocket listener thread.

Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.

Memory corruption when the mapped pages in VBO are still mapped after reclaiming by shrinker.

Memory corruption when kernel driver attempts to trigger hardware fences.

Memory corruption while processing graphics kernel driver request to create DMA fence.

Memory corruption when memory mapped in a VBO is not unmapped by the GPU SMMU.

Transient DOS during music playback of ALAC content.

Memory corruption while handling user packets during VBO bind operation.

Memory corruption while invoking IOCTL call for GPU memory allocation and size param is greater than expected size.

Information Disclosure while parsing beacon frame in STA.

transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA.

Memory corruption when the IOCTL call is interrupted by a signal.

Memory corruption as GPU registers beyond the last protected range can be accessed through LPAC submissions.

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.

Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.

Memory corruption while copying the sound model data from user to kernel buffer during sound model register.

Memory corruption when the bandpass filter order received from AHAL is not within the expected range.

Memory corruption when multiple listeners are being registered with the same file descriptor.

Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.

Memory corruption while parsing qcp clip with invalid chunk data size.

Transient DOS while processing channel information for speaker protection v2 module in ADSP.

Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.

Memory corruption when AP includes TID to link mapping IE in the beacons and STA is parsing the beacon TID to link mapping IE.

Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size.

Memory corruption in Automotive Multimedia due to improper access control in HAB.

Memory corruption in HLOS while converting from authorization token to HIDL vector.

Information disclosure in Audio while accessing AVCS services from ADSP payload.

Transient DOS in Audio when invoking callback function of ASM driver.

Memory corruption in core services when Diag handler receives a command to configure event listeners.

Memory corruption in Automotive Display while destroying the image handle created using connected display driver.

Weak configuration in Automotive while VM is processing a listener request from TEE.