sdm429w firmware · threatengine.sh

Home/Product/qualcomm sdm429w firmware

Product

qualcomm sdm429w firmware

460 known vulnerabilities across versions

Vulnerabilities are listed by affected version. Select any CVE for the full briefing and its intelligence graph.

Sort Min CVSS Published since

Memory corruption while using alignments for memory allocation.

Weak configuration may lead to cryptographic issue when a VoWiFi call is triggered from UE.

Memory corruption while handling buffer mapping operations in the cryptographic driver.

Memory corruption while processing MFC channel configuration during music playback.

Memory corruption while processing a GP command response.

Memory corruption during PlayReady APP usecase while processing TA commands.

Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set.

Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than th

Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP pa

Memory corruption when the UE receives an RTP packet from the network, during the reassembly of NALUs.

Cryptographic issue while performing RSA PKCS padding decoding.

Memory corruption while processing specific files in Powerline Communication Firmware.

Transient DOS when importing a PKCS#8-encoded RSA private key with a zero-sized modulus.

Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

Information disclosure may occur while processing goodbye RTCP packet from network.

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

Memory corruption may occur while processing the OIS packet parser.

Memory corruption while handling test pattern generator IOCTL command.

Memory corruption while processing I2C settings in Camera driver.

Memory corruption while processing IOCTL command to handle buffers associated with a session.

Memory corruption may occur while processing voice call registration with user.

Transient DOS while processing of a registration acceptance OTA due to incorrect ciphering key data IE.

Memory corruption while triggering commands in the PlayReady Trusted application.

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

Memory corruption while processing an IOCTL call to set mixer controls.

Memory corruption can occur during context user dumps due to inadequate checks on buffer length.

Memory corruption while sound model registration for voice activation with audio kernel driver.

Memory corruption may occur when invoking IOCTL calls from userspace to the camera kernel driver to dump request information, due

Memory corruption while acquire and update IOCTLs during IFE output resource ID validation.

Memory corruption while invoking IOCTL calls from userspace to camera kernel driver to dump request information.

Memory corruption while prociesing command buffer in OPE module.

Memory corruption Camera kernel when large number of devices are attached through userspace.

Memory corruption during array access in Camera kernel due to invalid index from invalid command data.

Memory corruption may occur during IO configuration processing when the IO port count is invalid.

Memory corruption due to improper bounds check while command handling in camera-kernel driver.

Memory corruption while encoding JPEG format.

Memory corruption during concurrent buffer access due to modification of the reference count.

Memory corruption when blob structure is modified by user-space after kernel verification.

Memory corruption during concurrent access to server info object due to incorrect reference count update.

Memory corruption while handling schedule request in Camera Request Manager(CRM) due to invalid link count in the corresponding se

Memory corruption during concurrent access to server info object due to unprotected critical field.

Memory corruption during concurrent SSR execution due to race condition on the global maps list.

Transient DOS while connecting STA to AP and initiating ADD TS request from AP to establish TSpec session.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request.

Memory corruption occurs while connecting a STA to an AP and initiating an ADD TS request from the AP to establish a TSpec session

Cryptographic issue may arise because the access control configuration permits Linux to read key registers in TCSR.

Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to

Information disclosure while creating MQ channels.

Memory corruption occurs during the copying of read data from the EEPROM because the IO configuration is exposed as shared memory.

Memory corruption while handling file descriptor during listener registration/de-registration.

Cryptographic issues while generating an asymmetric key pair for RKP use cases.

There may be information disclosure during memory re-allocation in TZ Secure OS.

Transient DOS may occur while processing the country IE.

Memory corruption in display driver while detaching a device.

Memory corruption may occur while accessing a variable during extended back to back tests.

Memory corruption may occur while validating ports and channels in Audio driver.

Memory corruption may occur during the synchronization of the camera`s frame processing pipeline.

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.

Memory corruption caused by missing locks and checks on the DMA fence and improper synchronization.

Memory corruption during voice activation, when sound model parameters are loaded from HLOS, and the received sound model list is

Memory corruption during voice activation, when sound model parameters are loaded from HLOS to ADSP.

Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node.

Memory corruption while processing command in Glink linux.

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Memory corruption while processing camera use case IOCTL call.

While processing the authentication message in UE, improper authentication may lead to information disclosure.

Memory corruption while power-up or power-down sequence of the camera sensor.

Memory corruption in Camera due to unusually high number of nodes passed to AXI port.

Memory corruption may occour while generating test pattern due to negative indexing of display ID.

Memory corruption while handling IOCTL call from user-space to set latency level.

Memory corruption while taking a snapshot with hardware encoder due to unvalidated userspace buffer.

Memory corruption while parsing the memory map info in IOCTL calls.

Information disclosure while processing IO control commands.

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in modem.

Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU

Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound

Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information.

Memory corruption while processing API calls to NPU with invalid input.

Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver.

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver.

Memory corruption when invalid input is passed to invoke GPU Headroom API call.

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

Memory corruption during GNSS HAL process initialization.

Memory corruption while processing GPU page table switch.

Memory corruption while processing voice packet with arbitrary data received from ADSP.

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Memory corruption while station LL statistic handling.

Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver.

Memory corruption while handling IOCTL calls in JPEG Encoder driver.

Transient DOS while parsing BTM ML IE when per STA profile is not included.

Transient DOS while parsing fragments of MBSSID IE from beacon frame.

Memory corruption while processing the update SIM PB records request.

memory corruption when WiFi display APIs are invoked with large random inputs.

Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE.

Memory corruption when two threads try to map and unmap a single node simultaneously.

Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.

Memory corruption when user provides data for FM HCI command control operations.

Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.

Memory corruption when the captureRead QDCM command is invoked from user-space.

Transient DOS while handling PS event when Program Service name length offset value is set to 255.

Memory corruption when Alternative Frequency offset value is set to 255.

memory corruption when an invalid firehose patch command is invoked.

Memory corruption while releasing shared resources in MinkSocket listener thread.

Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of

Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.

Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.

Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU

Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.

Transient DOS while decoding attach reject message received by UE, when IEI is set to ESM_IEI.

Memory corruption when allocating and accessing an entry in an SMEM partition.

Memory corruption while performing finish HMAC operation when context is freed by keymaster.

Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immedia

Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than

Information disclosure while parsing dts header atom in Video.

Memory corruption when there is failed unmap operation in GPU.

Memory corruption while processing finish_sign command to pass a rsp buffer.

Memory corruption in SPS Application while requesting for public key in sorter TA.

Memory corruption in Audio while processing RT proxy port register driver.

Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitr

Memory corruption in Audio while processing the calibration data returned from ACDB loader.

Memory corruption in Audio while processing IIR config data from AFE calibration block.

Memory corruption in Audio while calling START command on host voice PCM multiple times for the same RX or TX tap points.

Information disclosure in Audio while accessing AVCS services from ADSP payload.

Transient DOS in Audio when invoking callback function of ASM driver.

Memory corruption in Audio when memory map command is executed consecutively in ADSP.

Memory corruption in Audio during playback with speaker protection.

Memory corruption in HLOS while running playready use-case.

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Transient DOS in Automotive OS due to improper authentication to the secure IO calls.

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Memory corruption while using the UIM diag command to get the operators name.

Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.

Memory corruption in MPP performance while accessing DSM watermark using external memory address.

Memory Corruption in SPS Application while exporting public key in sorter TA.

Memory corruption in Audio while processing the VOC packet data from ADSP.

Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer.

Memory corruption while processing audio effects.

Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.

Information Disclosure in data Modem while parsing an FMTP line in an SDP message.

Information Disclosure in Data Modem while performing a VoLTE call with an undefined RTCP FB line value.

Memory Corruption in Data Modem while making a MO call or MT VOLTE call.

Transient DOS in WLAN Host when an invalid channel (like channel out of range) is received in STA during CSA IE.

Transient DOS in WLAN Host while doing channel switch announcement (CSA), when a mobile station receives invalid channel in CSA IE

Memory corruption while allocating memory in COmxApeDec module in Audio.

Memory Corruption in Audio while playing amrwbplus clips with modified content.

Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key.

Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.

Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.

Memory Corruption in Audio while allocating the ion buffer during the music playback.

Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.

Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.

Information Disclosure in WLAN HOST while sending DPP action frame to peer with an invalid source address.

Transient DOS while parsing WLAN beacon or probe-response frame.

Transient DOS in WLAN Firmware while processing frames with missing header fields.

Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.

Memoru corruption in Audio when ADSP sends input during record use case.

Memory corruption in WLAN HOST while receiving an WMI event from firmware.

Transient DOS due to improper authorization in Modem

Memory corruption in Linux while sending DRM request.

Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.

Memory corruption in Linux android due to double free while calling unregister provider after register call.

information disclosure due to cryptographic issue in Core during RPMB read request.

Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool.

Memory corruption in Graphics while importing a file.

Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.

Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.

Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command le

Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.

Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.

Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.

Memory corruption in WLAN due to use after free

Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.

Memory corruption in modem due to buffer overflow while processing a PPP packet

Memory corruption in modem due to integer overflow to buffer overflow while handling APDU response

Memory corruption in Modem due to usage of Out-of-range pointer offset in UIM

Information Disclosure in Graphics during GPU context switch.

Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.

Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.

Memory corruption due to improper access control in Qualcomm IPC.

Memory corruption due to configuration weakness in modem wile sending command to write protected files.

Memory corruption due to use after free in trusted application environment.

Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modif

Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from pe

Memory corruption in video driver due to type confusion error during video playback

Memory corruption in display due to double free while allocating frame buffer memory

Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields

Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote

Denial of service while processing fastboot flash command on mmc due to buffer over read

Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP. in Snapdragon Auto, Snapdragon

Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Comp

Memory corruption in SPI buses due to improper input validation while reading address configuration from spi buses in Snapdragon M

Memory corruption in i2c buses due to improper input validation while reading address configuration from i2c driver in Snapdragon

Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto,

Denial of service in Modem due to reachable assertion while processing the common config procedure in Snapdragon Auto, Snapdragon

Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapd

Memory corruption in MODEM UIM due to usage of out of range pointer offset while decoding command from card in Snapdragon Auto, Sn

Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Con

Memory corruption in video due to configuration weakness. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra

Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdr

Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdr

Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Sna

Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdrag

Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdrag

Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Co

memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne

Memory corruption due to use after free in service while trying to access maps by different threads in Snapdragon Auto, Snapdragon

Information disclosure due to exposure of information while GPU reads the data in Snapdragon Auto, Snapdragon Compute, Snapdragon

Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv

Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapd

Information disclosure in Bluetooth driver due to buffer over-read while reading l2cap length in Snapdragon Auto, Snapdragon Compu

Memory corruption in video due to buffer overflow while parsing ps video clips in Snapdragon Auto, Snapdragon Compute, Snapdragon

Denial of service in video due to buffer over read while parsing MP4 clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Conne

Memory corruption in kernel due to improper input validation while processing ION commands in Snapdragon Auto, Snapdragon Connecti

Information disclosure in video due to buffer over-read while processing avi file in Snapdragon Compute, Snapdragon Connectivity,

Memory Corruption during wma file playback due to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity

Memory corruption in video driver due to double free while parsing ASF clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Con

Memory corruption due to buffer overflow while parsing MKV clips with invalid bitmap size in Snapdragon Auto, Snapdragon Compute,

Memory corruption due to incorrect pointer arithmetic when attempting to change the endianness in video parser function in Snapdra

An out-of-bounds read can occur while parsing a server certificate due to improper length check in Snapdragon Auto, Snapdragon Com

A null pointer dereference may potentially occur during RSA key import in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti

Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Sna

Non-secure region can try modifying RG permissions of IO space xPUs due to improper input validation in Snapdragon Auto, Snapdrago

Possible authentication bypass due to improper order of signature verification and hashing in the signature verification call in S

memory corruption in video due to buffer overflow while parsing mkv clip with no codechecker in Snapdragon Auto, Snapdragon Comput

Memory corruption in video due to double free while parsing 3gp clip with invalid meta data atoms in Snapdragon Auto, Snapdragon C

Memory corruption in video due to buffer overflow while reading the dts file in Snapdragon Auto, Snapdragon Compute, Snapdragon Co

Memory corruption when extracting qcp audio file due to lack of check on data length in Snapdragon Auto, Snapdragon Compute, Snapd

Denial of service due to memory corruption while extracting ape header from clips in Snapdragon Auto, Snapdragon Compute, Snapdrag

Memory corruption due to possible buffer overflow while parsing DSF header with corrupted channel count in Snapdragon Auto, Snapdr

Out of bound read in WLAN HOST due to improper length check can lead to DOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Con

Possible buffer over read due to lack of size validation while unpacking frame in Snapdragon Auto, Snapdragon Compute, Snapdragon

Improper handling between export and release functions on the same handle from client can lead to use after free in Snapdragon Com

An out-of-bounds write can occur due to an incorrect input check in the camera driver in Snapdragon Auto, Snapdragon Compute, Snap

APK can load a crafted model into the CDSP which can lead to a compromise of CDSP and other APK`s data executing there in Snapdrag

A user with user level permission can access graphics protected region due to improper access control in register configuration in

Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compu

Possible buffer over read due to improper calculation of string length while parsing Id3 tag in Snapdragon Auto, Snapdragon Comput

Improper validation of session id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Sna

Possible out of bound read due to improper validation of certificate chain in SSL or Internet key exchange in Snapdragon Auto, Sna

Possible buffer overflow due to improper validation of array index while processing external DIAG command in Snapdragon Auto, Snap

Improper access control sequence for AC database after memory allocation can lead to possible memory corruption in Snapdragon Auto

Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Comp

Improper integrity check can lead to race condition between tasks PDCP and RRC? after a valid RRC Command packet has been received

Improper buffer size validation of DSM packet received can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapd

Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon

Possible out of bounds access due to improper input validation during graphics profiling in Snapdragon Auto, Snapdragon Compute, S

Improper validation of buffer size input to the EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Sna

Lack of null check while freeing the device information buffer in the Bluetooth HFP protocol can lead to a NULL pointer dereferenc

Improper validation of maximum size of data write to EFS file can lead to memory corruption in Snapdragon Auto, Snapdragon Compute

Improper validation of input when provisioning the HDCP key can lead to memory corruption in Snapdragon Auto, Snapdragon Compute,

Improper validation of function pointer type with actual function signature can lead to assertion in Snapdragon Auto, Snapdragon C

Possible null pointer dereference due to improper validation of APE clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec

Possible denial of service due to incorrectly decoding hex data for the SIB2 OTA message and assigning a garbage value to choice w

An out of bound memory access can occur due to improper validation of number of frames being passed during music playback in Snapd

Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdrago

Possible assertion in QOS request due to improper validation when multiple add or update request are received simultaneously in Sn

Possible buffer overflow due to lack of range check while processing a DIAG command for COEX management in Snapdragon Auto, Snapdr

Possible assertion due to improper handling of IPV6 packet with invalid length in destination options header in Snapdragon Auto, S

Possible null pointer dereference in thread cache operation handler due to lack of validation of user provided input in Snapdragon

Possible null pointer dereference in trap handler due to lack of thread ID validation before dereferencing it in Snapdragon Auto,

Possible null pointer dereference in thread profile trap handler due to lack of thread ID validation before dereferencing it in Sn

Possible heap Memory Corruption Issue due to lack of input validation when sending HWTC IQ Capture command in Snapdragon Auto, Sna

Improper validation of a socket state when socket events are being sent to clients can lead to invalid access of memory in Snapdra

Possible buffer overflow due to improper input validation in PDM DIAG command in FTM in Snapdragon Auto, Snapdragon Compute, Snapd

Possible buffer overflow due to improper input validation in factory calibration and test DIAG command in Snapdragon Auto, Snapdra

Possible heap overflow due to improper length check of domain while parsing the DNS response in Snapdragon Auto, Snapdragon Comput

A FTM Diag command can allow an arbitrary write into modem OS space in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit

Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon

Possible buffer overflow due to improper size calculation of payload received in VR service in Snapdragon Auto, Snapdragon Compute

Possible memory corruption due to lack of bound check of input index in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi

Possible integer overflow due to improper check of batch count value while sanitizer is enabled in Snapdragon Auto, Snapdragon Com

Null pointer dereference can occur due to lack of null check for user provided input in Snapdragon Auto, Snapdragon Compute, Snapd

Possible integer and heap overflow due to lack of input command size validation while handling beacon template update command from

A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Snapdragon Com

Use-after-free vulnerability in kernel graphics driver because of storing an invalid pointer in Snapdragon Compute, Snapdragon Con

Null pointer dereference occurs due to improper validation when the preemption feature enablement is toggled in Snapdragon Auto, S

Possible heap overflow due to improper validation of local variable while storing current task information locally in Snapdragon A

Possible buffer over read due to lack of alignment between map or unmap length of IPA SMMU and WLAN SMMU in Snapdragon Auto, Snapd

Possible null pointer dereference due to lack of validation check for passed pointer during key import in Snapdragon Auto, Snapdra

UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdr

Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto, Snapdragon Compute, S

Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Compute, Snap

Possible buffer underflow due to lack of check for negative indices values when processing user provided input in Snapdragon Auto,

Loop with unreachable exit condition may occur due to improper handling of unsupported input in Snapdragon Auto, Snapdragon Comput

Child process can leak information from parent process due to numeric pids are getting compared and these pid can be reused in Sna

Denial of service in SAP case due to improper handling of connections when association is rejected in Snapdragon Auto, Snapdragon

Possible buffer over read due to lack of length check while flashing meta images in Snapdragon Consumer IOT, Snapdragon Industrial

Improper length check of public exponent in RSA import key function could cause memory corruption. in Snapdragon Auto, Snapdragon

Possible buffer overflow due to lack of length check in Trusted Application in Snapdragon Auto, Snapdragon Compute, Snapdragon Con

Memory corruption in key parsing and import function due to double freeing the same heap allocation in Snapdragon Auto, Snapdragon

Incorrect handling of pointers in trusted application key import mechanism could cause memory corruption in Snapdragon Auto, Snapd

Buffer overflow in modem due to improper array index check before copying into it in Snapdragon Auto, Snapdragon Compute, Snapdrag

Possible buffer overflow in voice service due to lack of input validation of parameters in QMI Voice API in Snapdragon Auto, Snapd

Stack out-of-bounds write occurs while setting up a cipher device if the provided IV length exceeds the max limit value in Snapdra

A race between command submission and destroying the context can cause an invalid context being added to the list leads to use aft

Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdra

Memory corruption due to ioctl command size was incorrectly set to the size of a pointer and not enough storage is allocated for t

Use after free issue when importing a DMA buffer by using the CPU address of the buffer due to attachment is not cleaned up proper

Resource leakage issue during dci client registration due to reference count is not decremented if dci client registration fails i

Possible use after free due to lack of null check while memory is being freed in FastRPC driver in Snapdragon Auto, Snapdragon Com

Double free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna

Improper handling of address deregistration on failure can lead to new GPU address allocation failure. in Snapdragon Auto, Snapdra

Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapd

Possible integer overflow due to improper length check while flashing an image in Snapdragon Consumer IOT, Snapdragon Industrial I

A possible use-after-free occurrence in audio driver can happen when pointers are not properly handled in Snapdragon Auto, Snapdra

Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, Snapdragon

Out of bound read can happen in Widevine TA while copying data to buffer from user data due to lack of check of buffer length rece

Out of bound write can occur in TZ command handler due to lack of validation of command ID in Snapdragon Auto, Snapdragon Compute,

Out-of-bounds read vulnerability while accessing DTMF payload due to lack of check of buffer length before copying in Snapdragon A

When sending a socket event message to a user application, invalid information will be passed if socket is freed by other thread r

Out of bound read occurs while processing crafted SDP due to lack of check of null string in Snapdragon Auto, Snapdragon Compute,

Use after free in GPU driver while mapping the user memory to GPU memory due to improper check of referenced memory in Snapdragon

Buffer overflow can occur in video while playing the non-standard clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connecti

Use after free condition in msm ioctl events due to race between the ioctl register and deregister events in Snapdragon Auto, Snap

Out of bound write while parsing RTT/TTY packet parsing due to lack of check of buffer size before copying into buffer in Snapdrag

Out of bound memory read in Data modem while unpacking data due to lack of offset length check in Snapdragon Auto, Snapdragon Comp

Usage of syscall by non-secure entity can allow extraction of secure QTEE diagnostic information in clear text form due to insuffi

HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in

Out of bound write while parsing SDP string due to missing check on null termination in Snapdragon Auto, Snapdragon Compute, Snapd

Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Sna

Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Sna

Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Sna

Buffer over-read can happen while parsing received SDP values due to lack of NULL termination check on SDP in Snapdragon Auto, Sna

Potential out of bound read exception when UE receives unusually large number of padding octets in the beginning of ROHC header in

Before enqueuing a frame to the PE queue for further processing, an entry in a hash table can be deleted and using a stale version

Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Aut

Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for par

Stack overflow may occur if GSM/WCDMA broadcast config size received from user is larger than variable length array in Snapdragon

User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device loc

Out of bound memory access while playing music playbacks with crafted vorbis content due to improper checks in header extraction i

u'When a non standard SIP sigcomp message is received from the network, then there may be chances of using more UDVM cycle or memo

u'Integer overflow to buffer overflow occurs while playback of ASF clip having unexpected number of codec entries' in Snapdragon A

u'Buffer over read can happen while parsing mkv clip due to improper typecasting of data returned from atomsize' in Snapdragon Aut

u'Null-pointer dereference can occur while accessing data buffer beyond its size that leads to access the buffer beyond its range'

u'information disclosure in gatekeeper trustzone implementation as the throttling mechanism to prevent brute force attempts at get

u'Use after free while installing new security rule in ipcrtr as old one is deleted and this rule could still be in use for checki

u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Aut

u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to valida

u'Potential out of bounds read while processing downlink NAS transport message due to improper length check of Information Element

u'Remote code execution can happen by sending a carefully crafted POST query when Device configuration is accessed from a tethered

u'Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it' in S

u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto,

u'Two threads running simultaneously from user space can lead to race condition in fastRPC driver' in Snapdragon Auto, Snapdragon

u'Third-party app may also call the broadcasts in Perfdump and cause privilege escalation issue due to improper access control' in

u'Possible buffer overflow in MHI driver due to lack of input parameter validation of EOT events received from MHI device side' in

u'Out of bound access can happen in MHI command process due to lack of check of channel id value received from MHI devices' in Sna

Out of bound access can happen in MHI command process due to lack of check of command channel id value received from MHI devices i

u'Multiple Read overflows issue due to improper length check while decoding Generic NAS transport/EMM info' in Snapdragon Auto, Sn

u'Buffer overflow seen as the destination buffer size is lesser than the source buffer size in video application' in Snapdragon Co

u'Information disclosure issue can occur due to partial secure display-touch session tear-down' in Snapdragon Auto, Snapdragon Com

u'A potential buffer overflow exists due to integer overflow when parsing handler options due to wrong data type usage in operatio

u'Channel name string which has been read from shared memory is potentially subjected to string manipulations but not validated fo

u'Lack of check to ensure that the TX read index & RX write index that are read from shared memory are less than the FIFO size res

u'Lack of check of integer overflow while doing a round up operation for data read from shared memory for G-link SMEM transport ca

u'Possible out of bound access while copying the mask file content into the buffer without checking the buffer size' in Snapdragon

u'Information exposure issues while processing IE header due to improper check of beacon IE frame' in Snapdragon Auto, Snapdragon

u'Possible out of bound write while processing association response received from host due to lack of check of IE length' in Snapd

u'Buffer over read occurs while processing information element from beacon due to lack of check of data received from beacon' in S

u'Information disclosure issue occurs as in current logic as secure touch is released without clearing the display session which c

u'Heap overflow in diag command handler due to lack of check of packet length received from user' in Snapdragon Auto, Snapdragon C

u'Lack of check for integer overflow for round up and addition operations result into memory corruption and potential information

u'Lack of check that the TX FIFO write and read indices that are read from shared RAM are less than the FIFO size results into mem

u'Lack of integer overflow check for addition of fragment size and remaining size that are read from shared memory can lead to mem

u'Lack of check that the current received data fragment size of a particular packet that are read from shared memory are less than

u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value and size of

u'SMEM partition can be manipulated in case of any compromise on HLOS, thus resulting in access to memory outside of SMEM address

Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in

Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Sn

Possible buffer overflow while parsing mp4 clip with corrupted sample atoms due to improper validation of index in Snapdragon Auto

Out of bounds read can happen in diag event set mask command handler when user provided length in the command request is less than

Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto,

Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snap

When kernel thread unregistered listener, Use after free issue happened as the listener client`s private data has been already fre

Buffer over-write may occur during fetching track decoder specific information if cb size exceeds buffer size in Snapdragon Auto,

Buffer overflow can occur while parsing eac3 header while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Com

Buffer overflow will happen while parsing mp4 clip with corrupted sample atoms values which exceeds MAX_UINT32 range due to lack o

Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdrago

Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdrago

Stack based overflow If the maximum number of arguments allowed per request in perflock exceeds in Snapdragon Auto, Snapdragon Com

Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Co

Possible buffer overflow while copying the frame to local buffer due to lack of check of length before copying in Snapdragon Auto,

Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet in Snapdra

Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overf

Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from network in Snap

Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snap

A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer

Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto,

Array out of bound may occur while playing mp3 file as no check is there on offset if it is greater than the buffer allocated or n

Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snap

Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no

Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channe

When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode

Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdragon Auto, Sn

Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command respo

Active command timeout since WM status change cmd is not removed from active queue if peer sends multiple deauth frames. in Snapdr

Possible buffer overflow while playing mkv clip due to lack of validation of atom size buffer in Snapdragon Auto, Snapdragon Compu

Possible use after free issue in pcm volume controls due to race condition exist in private data used in mixer controls in Snapdra

Multiple Read overflows issue due to improper length check while decoding tau reject/tau accept/detach request/attach reject/attac

Possible buffer overrun when processing EFS filename and payload sent over diag interface due to lack of check for filename length

Multiple Read overflows issue due to improper length check while decoding dedicated_eps_bearer_req/ act_def_context_req/ cs_serv_n

Multiple Read overflows issue due to improper length check while decoding RAU accept/PDN disconnect Rej/Modify EPS ctxt req/bearer

Possible out of bound array access as there is no check on carrier index passed in Snapdragon Auto, Snapdragon Compute, Snapdragon

Multiple Read overflows issue due to improper length check while decoding 3G attach accept/ SMS/ pdn connection reject/ esm data t

Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Indu

Out of bound access in diag services when DCI command buffer reallocation is not done properly with required capacity in Snapdrago

Possible buffer over read when trying to process SDP message Video media line with frame-size attribute in video Media line in Sna

Out of bound write can happen due to lack of check of array index value while calculating it. in Snapdragon Auto, Snapdragon Compu

Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overf

Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute,

Missing length check before copying the data from kernel space to userspace through the copy function can lead to buffer overflow

String error while processing non standard SIP messages received can lead to buffer overread and then denial of service in Snapdra

Target specific data is being sent to remote server and leads to information exposure in Snapdragon Auto, Snapdragon Compute, Snap

Buffer overflow occurs while processing LMP packet in which name length parameter exceeds value specified in BT-specification in S

Access to the uninitialized variable when the driver tries to unmap the dma buffer of a request which was never mapped in the firs

Unhandled paging request is observed due to dereferencing an already freed object because of race condition between sparse free an

Out of bound access in msm routing due to lack of check of size before accessing in Snapdragon Auto, Snapdragon Compute, Snapdrago

Null-pointer dereference can occur while accessing the segment element info when it is not allocated and assigned in Snapdragon Au

Use-after-free in graphics module due to destroying already queued syncobj in error case in Snapdragon Auto, Snapdragon Compute, S

Lack of check that the RX FIFO write index that is read from shared RAM is less than the FIFO size results into memory corruption

Stack overflow can occur when SDP is received with multiple payload types in the FMTP attribute of a video M line in Snapdragon Au

Buffer overflow can occur when processing non standard SDP video Image attribute parameter in a VILTE\VOLTE call in Snapdragon Aut

Null pointer dereference can happen when parsing udta atom which is non-standard and having invalid depth in Snapdragon Auto, Snap

Possible Stack overflow can occur when processing a large SDP body or non standard SDP body without right delimiters in Snapdragon

Filling media attribute tag names without validating the destination buffer size which can result in the buffer overflow in Snapdr

Improper input validation while processing SIP URI received from the network will lead to buffer over-read and then to denial of s

Multiple Read overflows issue due to improper length check while decoding Identity Request in CSdomain/Authentication Reject in CS

Multiple Read overflows due to improper length checks while decoding authentication in Cs domain/RAU Reject and TC cmd in Snapdrag

Multiple Buffer Over-read issue can happen due to improper length checks while decoding Service Reject/RAU Reject/PTMSI Realloc cm

Buffer Over-read when UE is trying to process the message received form the network without zero termination in Snapdragon Auto, S

Null pointer dereference issue can happen due to improper validation of CSEQ header response received from network in Snapdragon A

Possible use after free issue while CRM is accessing the link pointer from device private data due to lack of resource protection

Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct size requi

Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Snapdragon Aut

Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer acc

During listener modified response processing, a buffer overrun occurs due to lack of buffer size verification when updating messag

Using memory after being freed in qsee due to wrong implementation can lead to unexpected behavior such as execution of unknown co

APKs without proper permission may bind to CallEnhancementService and can lead to unauthorized access to call status in Snapdragon

Out of bound access while parsing dts atom, which is non-standard as it does not have valid number of tracks in Snapdragon Auto, S

There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing command

Use after free while processing eeprom query as there is a chance to not unlock mutex after error occurs in Snapdragon Auto, Snapd

Heap buffer overflow can occur while parsing invalid MKV clip which is not standard and have invalid vorbis codec data in Snapdrag

Integer overflow occurs while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit

While parsing invalid super index table, elements within super index table may exceed total chunk size and invalid data is read in

Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdrago

Buffer overflow occur while playing the clip which is nonstandard due to lack of check of size duration in Snapdragon Auto, Snapdr

Buffer overflow occurs while processing invalid MKV clip, which has invalid EBML size in Snapdragon Auto, Snapdragon Compute, Snap

Null pointer exception can happen while parsing invalid MKV clip where cue information is parsed before segment information in Sna

Buffer overflow can occur while processing clip due to lack of check of object size before parsing in Snapdragon Auto, Snapdragon

Possible integer overflow happens when mmap find function will increment refcount every time when it invokes and can lead to use a

Use after free issue occurs when camera access sensors data through direct report mode in Snapdragon Auto, Snapdragon Compute, Sna

Use after free issue due to using of invalidated iterator to delete an object in sensors HAL in Snapdragon Auto, Snapdragon Consum

Buffer over-read can occur while playing the video clip which is not standard in Snapdragon Auto, Snapdragon Compute, Snapdragon C

Null pointer dereference can occur while parsing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon

While transferring data from APPS to DSP, Out of bound in FastRPC HLOS Driver due to the data buffer which can be controlled by DS

While trying to obtain datad ipc handle during DPL initialization, Heap use-after-free issue can occur if modem SSR occurs at same

Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdragon Auto, Sna

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin