sa8540p firmware · threatengine.sh

Home/Product/qualcomm sa8540p firmware

Product

qualcomm sa8540p firmware

233 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

Memory corruption when buffer copy operation fails due to integer overflow during attestation report generation.

Memory Corruption when accessing buffers with invalid length during TA invocation.

Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input.

Memory corruption while calculating offset from partition start point.

Memory corruption when calculating oversized partition sizes without proper checks.

Memory corruption while processing identity credential operations in the trusted application.

Memory corruption while processing a secure logging command in the trusted application.

Cryptographic issue may occur while encrypting license data.

Memory corruption while deinitializing a HDCP session.

Memory corruption while routing GPR packets between user and root when handling large data packet.

Information disclosure while exposing internal TA-to-TA communication APIs to HLOS

Memory corruption while processing large input data from a remote source via a communication interface.

Information disclosure while processing message from client with invalid payload.

Memory corruption when triggering a subsystem crash with an out-of-range identifier.

Memory corruption while processing client message during device management.

Memory corruption while performing encryption and decryption commands.

Information disclosure while registering commands from clients with diag through diagHal.

Memory corruption while processing control commands in the virtual memory management interface.

Memory corruption while processing a malformed license file during reboot.

Memory corruption during PlayReady APP usecase while processing TA commands.

Memory corruption while handling repeated memory unmap requests from guest VM.

Memory corruption while processing data sent by FE driver.

Memory corruption while processing message in guest VM.

memory corruption while loading a PIL authenticated VM, when authenticated VM image is loaded without maintaining cache coherency.

information disclosure while invoking calibration data from user space to update firmware size.

Cryptographic issue while performing RSA PKCS padding decoding.

Memory corruption while performing private key encryption in trusted application.

Information disclosure while processing a packet at EAVB BE side with invalid header length.

Information disclosure while capturing logs as eSE debug messages are logged.

Information disclosure while processing the hash segment in an MBN file.

Information disclosure while reading data from an image using specified offset and size parameters.

Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.

Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmwar

Transient DOS while handling beacon frames with invalid IE header length.

Memory corruption while processing video packets received from video firmware.

Memory corruption while copying the result to the transmission queue which is shared between the virtual machine and the host.

Memory corruption while copying the result to the transmission queue in EMAC.

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

Memory corruption while retrieving the CBOR data from TA.

Cryptographic issue while processing crypto API calls, missing checks may lead to corrupted key usage or IV reuses.

Memory corruption while operating the mailbox in Automotive.

Transient DOS while processing the EHT operation IE in the received beacon frame.

Memory corruption may occur while processing voice call registration with user.

Memory corruption may occur while attaching VM when the HLOS retains access to VM.

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null

Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously.

Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures oc

Memory corruption during the FRS UDS generation process.

Memory corruption while triggering commands in the PlayReady Trusted application.

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

Memory corruption while reading secure file.

Memory corruption while sound model registration for voice activation with audio kernel driver.

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

Memory corruption during concurrent access to server info object due to incorrect reference count update.

Memory corruption during concurrent access to server info object due to unprotected critical field.

Memory corruption while processing message content in eAVB.

Memory corruption while transmitting packet mapping information with invalid header payload size.

Transient DOS may occur while parsing EHT operation IE or EHT capability IE.

Information disclosure may be there when a guest VM is connected.

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Memory corruption may occur due top improper access control in HAB process.

Cryptographic issue occurs during PIN/password verification using Gatekeeper, where RPMB writes can be dropped on verification fai

Information disclosure while creating MQ channels.

Memory corruption while accessing MSM channel map and mixer functions.

Memory corruption while invoking IOCTL map buffer request from userspace.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Cryptographic issues while generating an asymmetric key pair for RKP use cases.

There may be information disclosure during memory re-allocation in TZ Secure OS.

Memory corruption while assigning memory from the source DDR memory(HLOS) to ADSP.

Memory corruption while calling the NPU driver APIs concurrently.

Memory corruption may occur in keyboard virtual device due to guest VM interaction.

Memory corruption while reading a type value from a buffer controlled by the Guest Virtual Machine.

Memory corruption while processing input message passed from FE driver.

Memory corruption while reading a value from a buffer controlled by the Guest Virtual Machine.

Memory corruption may occur while processing message from frontend during allocation.

Transient DOS may occur while processing the country IE.

Memory corruption in display driver while detaching a device.

Memory corruption may occur while accessing a variable during extended back to back tests.

Memory corruption may occur during communication between primary and guest VM.

Memory corruption may occur while validating ports and channels in Audio driver.

Memory corruption may occur due to improper input validation in clock device.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Information disclosure while deriving keys for a session for any Widevine use case.

Memory corruption during management frame processing due to mismatch in T2LM info element.

Information disclosure while parsing the OCI IE with invalid length.

Memory corruption while reading CPU state data during guest VM suspend.

Memory corruption while parsing the ML IE due to invalid frame content.

Memory corruption while configuring a Hypervisor based input virtual device.

Memory corruption while parsing the memory map info in IOCTL calls.

Information disclosure while processing IO control commands.

Information disclosure during audio playback.

Information disclosure while processing information on firmware image during core initialization.

Transient DOS can occur when GVM sends a specific message type to the Vdev-FastRPC backend.

Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the

Memory corruption can occur if an already verified IFS2 image is overwritten, bypassing boot verification. This allows unauthorize

Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU

information disclosure while invoking the mailbox read API.

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound

Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Memory corruption when multiple threads try to unregister the CVP buffer at the same time.

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message r

Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and

Memory corruption while processing GPU page table switch.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while handling session errors from firmware.

Transient DOS while processing the CU information from RNR IE.

Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it.

Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.

Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating t

Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improp

Memory corruption when BTFM client sends new messages over Slimbus to ADSP.

Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.

memory corruption when an invalid firehose patch command is invoked.

Memory corruption while releasing shared resources in MinkSocket listener thread.

Cryptographic issue while parsing RSA keys in COBR format.

Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.

Memory corruption while creating a fence to wait on timeline events, and simultaneously signal timeline events.

Memory corruption while processing IOCTL call to set metainfo.

Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.

Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than nei

Transient DOS while parsing ESP IE from beacon/probe response frame.

Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.

Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.

Memory corruption during session sign renewal request calls in HLOS.

Memory corruption when keymaster operation imports a shared key.

Memory corruption when preparing a shared memory notification for a memparcel in Resource Manager.

Transient DOS during music playback of ALAC content.

Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released.

Memory corruption when an invoke call and a TEE call are bound for the same trusted application.

Memory corruption while processing key blob passed by the user.

Transient DOS while loading the TA ELF file.

Memory corruption while performing finish HMAC operation when context is freed by keymaster.

Memory corruption in Hypervisor when platform information mentioned is not aligned.

Memory corruption while copying a keyblobs material when the key materials size is not accurately checked.

Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.

Memory corruption while playing audio file having large-sized input buffer.

Memory corruption when the payload received from firmware is not as per the expected protocol size.

Memory corruption when size of buffer from previous call is used without validation or re-initialization.

Memory corruption when IOMMU unmap of a GPU buffer fails in Linux.

Memory corruption while verifying the serialized header when the key pairs are generated.

Memory corruption in HLOS while checking for the storage type.

Memory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.

Memory corruption while processing buffer initialization, when trusted report for certain report types are generated.

Memory corruption while processing finish_sign command to pass a rsp buffer.

Memory corruption in SPS Application while requesting for public key in sorter TA.

Memory corruption in Core Services while executing the command for removing a single event listener.

Memory corruption in Automotive Multimedia due to improper access control in HAB.

Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.

Memory corruption in Core while processing control functions.

Memory corruption in Trusted Execution Environment while deinitializing an object used for license validation.

Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.

Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.

Memory corruption in HLOS while running playready use-case.

Transient DOS in Automotive OS due to improper authentication to the secure IO calls.

Memory corruption in HLOS while invoking IOCTL calls from user-space.

Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.

Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.

Memory corruption while loading an ELF segment in TEE Kernel.

Memory Corruption in SPS Application while exporting public key in sorter TA.

Cryptographic issue in HLOS during key management.

Memory corruption in TZ Secure OS while loading an app ELF.

Memory Corruption in Core due to secure memory access by user while loading modem image.

Memory corruption in Automotive Display while destroying the image handle created using connected display driver.

Memory Corruption in HLOS while registering for key provisioning notify.

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.

Weak configuration in Automotive while VM is processing a listener request from TEE.

Improper Access to the VM resource manager can lead to Memory Corruption.

Memory Corruption in Core Platform while printing the response buffer in log.

Memory corruption in Core Platform while printing the response buffer in log.

Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.

Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.

Memory corruption due to untrusted pointer dereference in automotive during system call.

Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.

Memory corruption in Automotive GPU while querying a gsl memory node.

Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request.

Memory corruption due to improper access control in kernel while processing a mapping request from root process.

Information disclosure in Kernel due to indirect branch misprediction.

Memory corruption due to double free in Core while mapping HLOS address to the list.

Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.

information disclosure due to cryptographic issue in Core during RPMB read request.

Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation.

Memory corruption in HAB Memory management due to broad system privileges via physical address.

Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a s

Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection

Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.

Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.

Memory corruption due to double free in core while initializing the encryption key.

Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer

Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.

Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.

Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory

Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file.

Memory corruption due to stack-based buffer overflow in Core

Information disclosure due to buffer overread in Core

Information disclosure due to buffer overread in Core

Memory corruption in core due to stack-based buffer overflow

Memory corruption in Core due to stack-based buffer overflow.

Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.

Memory corruption in Automotive due to improper input validation.

Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping.

Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor tran

Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a v

Information disclosure due to buffer over read in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdrag

Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,

Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon I

Memory corruption in multimedia due to improper length check while copying the data in Snapdragon Auto

Memory corruption in multimedia due to improper check on the messages received. in Snapdragon Auto

Denial of service in multimedia due to uncontrolled resource consumption while parsing an incoming HAB message in Snapdragon Auto

Memory corruption in multimedia due to improper check on received export descriptors in Snapdragon Auto

Memory corruption in multimedia due to improper validation of array index in Snapdragon Auto

A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti

Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Sna

Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdrago

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in S

Memory corruption in multimedia driver due to double free while processing data from user in Snapdragon Auto

Improper buffer initialization on the backend driver can lead to buffer overflow in Snapdragon Auto

Improper handling of writes to virtual GICR control can lead to assertion failure in the hypervisor in Snapdragon Auto, Snapdragon

Improper verification of timeout-based authentication in identity credential can lead to invalid authorization in HLOS in Snapdrag

Possible hypervisor memory corruption due to TOC TOU race condition when updating address mappings in Snapdragon Auto, Snapdragon

Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile

Improper cleaning of secure memory between authenticated users can lead to face authentication bypass in Snapdragon Auto, Snapdrag

Possible null pointer dereference due to lack of TLB validation for user provided address in Snapdragon Auto, Snapdragon Compute,

Improper access control in TrustZone due to improper error handling while handling the signing key in Snapdragon Auto, Snapdragon

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin