| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Memory Corruption in SPS Application while exporting public key in sorter TA. |
| Memory corruption while loading an ELF segment in TEE Kernel. |
| Memory corruption while sending SMS from AP firmware. |
| Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities. |
| Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE. |
| Memory corruption while processing MFC channel configuration during music playback. |
| Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet. |
| Memory corruption during video playback when video session open fails with time out error. |
| Information disclosure while exposing internal TA-to-TA communication APIs to HLOS |
| Memory corruption while handling IOCTL calls to set mode. |
| Memory corruption while routing GPR packets between user and root when handling large data packet. |
| Memory corruption while loading an invalid firmware in boot loader. |
| Memory Corruption when processing IOCTLs for JPEG data without verification. |
| Memory corruption while copying packets received from unix clients. |
| Dell Wireless 5932e and Qualcomm Snapdragon X62 Firmware and GNSS/GPS Driver, versions prior to 3.2.0.22 contain an Unquoted Search Path or Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code Execution. |
| Memory corruption while taking snapshot when an offset variable is set by camera driver. |
| Information disclosure while processing system calls with invalid parameters. |
| Memory corruption while handling concurrent memory mapping and unmapping requests from a user-space application. |
| In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix node corruption in ar->arvifs list
In current WLAN recovery code flow, ath11k_core_halt() only
reinitializes the "arvifs" list head. This will cause the
list node immediately following the list head to become an
invalid list node. Because the prev of that node still points
to the list head "arvifs", but the next of the list head "arvifs"
no longer points to that list node.
When a WLAN recovery occurs during the execution of a vif
removal, and it happens before the spin_lock_bh(&ar->data_lock)
in ath11k_mac_op_remove_interface(), list_del() will detect the
previously mentioned situation, thereby triggering a kernel panic.
The fix is to remove and reinitialize all vif list nodes from the
list head "arvifs" during WLAN halt. The reinitialization is to make
the list nodes valid, ensuring that the list_del() in
ath11k_mac_op_remove_interface() can execute normally.
Call trace:
__list_del_entry_valid_or_report+0xb8/0xd0
ath11k_mac_op_remove_interface+0xb0/0x27c [ath11k]
drv_remove_interface+0x48/0x194 [mac80211]
ieee80211_do_stop+0x6e0/0x844 [mac80211]
ieee80211_stop+0x44/0x17c [mac80211]
__dev_close_many+0xac/0x150
__dev_change_flags+0x194/0x234
dev_change_flags+0x24/0x6c
devinet_ioctl+0x3a0/0x670
inet_ioctl+0x200/0x248
sock_do_ioctl+0x60/0x118
sock_ioctl+0x274/0x35c
__arm64_sys_ioctl+0xac/0xf0
invoke_syscall+0x48/0x114
...
Tested-on: QCA6698AQ hw2.1 PCI WLAN.HSP.1.1-04591-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 |
| Memory corruption while processing IOCTL command to handle buffers associated with a session. |
