| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 400, SD 450, SD 410/12, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SDX20, lack of input validation on BT HCI commands processing allows privilege escalation. |
| Transient DOS while parsing ESP IE from beacon/probe response frame. |
| Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report. |
| Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. |
| Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length. |
| Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame. |
| Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp. |
| Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events. |
| Memory corruption while allocating memory in HGSL driver. |
| Memory corruption while processing IOCTL call to set metainfo. |
| Transient DOS while processing TID-to-link mapping IE elements. |
| Transient DOS while parsing the received TID-to-link mapping action frame. |
| Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released. |
| Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table. |
| Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time. |
| Memory corruption during GNSS HAL process initialization. |
| Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. |
| Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it. |
| Transient DOS while parsing fragments of MBSSID IE from beacon frame. |
| Transient DOS while parsing BTM ML IE when per STA profile is not included. |
