qualcomm / fastconnect_7800 CVEs

Memory corruption while invoking IOCTLs calls from user space for internal mem MAP and internal mem UNMAP.

Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.

Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.

Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.

Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.

Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.

Memory corruption while running VK synchronization with KASAN enabled.

Memory corruption in wearables while processing data from AON.

Transient DOS in Data Modem during DTLS handshake.

Memory corruption while receiving a message in Bus Socket Transport Server.

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.

Information disclosure in Core services while processing a Diag command.

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

Transient DOS in WLAN Firmware while processing a FTMR frame.

Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.

Transient DOS when processing a NULL buffer while parsing WLAN vdev.

Transient DOS in Bluetooth Host while rfc slot allocation.

Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.

Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.

Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.

Memory Corruption in Audio while invoking IOCTLs calls from the user-space.

Memory corruption in WLAN HOST while processing the WLAN scan descriptor list.

Memory corruption while processing audio effects.

Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.