Qualcomm QCA6436

Improper input Validation in Multi-Mode Call Processor

Loop with Unreachable Exit Condition (Infinite Loop) in WLAN Firmware

NULL Pointer Dereference in WLAN Firmware

Reachable Assertion in WLAN Firmware

Reachable Assertion in Data Modem

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Firmware

Buffer Over-read in Audio

Reachable Assertion in Modem

NULL pointer Dereference in Modem

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Buffer Copy Without Checking Size of Input in WLAN Host

Integer Overflow or Wraparound in WLAN Host

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN HOST

Buffer Over-read in WLAN HOST

Buffer Over-read in WLAN Host Communication

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Firmware

Buffer Over-read in WLAN Host

Buffer Over-read in WLAN Host Communication

Buffer over-read in WLAN

Reachable Assertion in WLAN Firmware

Buffer Over-read in WLAN Firmware

Reachable Assertion in Modem

Buffer Over-read in WLAN Firmware

Insufficient Granularity of Access Control in Core

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Buffer over-read in Trusted Execution Environment

Buffer overflow occurs when trying to convert ASCII string to Unicode string if the actual size is more than required in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Possible buffer overflow due to improper validation of buffer length while processing fast boot commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music

Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggered and callback instance is deleted in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

Out of bound access due to usage of an out-of-range pointer offset in the camera driver. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Out of bound memory access in camera driver due to improper validation on data coming from UMD which is used for offset manipulation of pointer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

Trustzone initialization code will disable xPU`s when memory dumps are enabled and lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking

Key material used for TZ diag buffer encryption and other data related to log buffer is not wiped securely due to improper usage of memset in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking