|
2023-08-08
|
CVE-2023-28575
|
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.
|
205_firmware, 215_firmware, Aqt1000_firmware, C\-V2x_9150_firmware, Fastconnect_6200_firmware, Fastconnect_6800_firmware, Fastconnect_6900_firmware, Fastconnect_7800_firmware, Qam8295p_firmware, Qca6391_firmware, Qca6420_firmware, Qca6426_firmware, Qca6430_firmware, Qca6436_firmware, Qca6574au_firmware, Qca6696_firmware, Qca8337_firmware, Qcn9074_firmware, Qcs410_firmware, Qcs610_firmware, Qcs8155_firmware, Sa6145p_firmware, Sa6150p_firmware, Sa6155p_firmware, Sa8145p_firmware, Sa8150p_firmware, Sa8155p_firmware, Sa8195p_firmware, Sa8295p_firmware, Sd210_firmware, Sd212_firmware, Sd855_firmware, Sd865_5g_firmware, Sdx55_firmware, Snapdragon_855\+\/860_firmware, Snapdragon_855_firmware, Snapdragon_865\+_5g_firmware, Snapdragon_865_5g_firmware, Snapdragon_870_5g_firmware, Snapdragon_8_gen_1_firmware, Snapdragon_w5\+_gen_1_firmware, Snapdragon_wear_4100\+_firmware, Snapdragon_x55_5g_firmware, Snapdragon_xr2_5g_firmware, Sw5100_firmware, Sw5100p_firmware, Sxr2130_firmware, Wcd9341_firmware, Wcd9370_firmware, Wcd9380_firmware, Wcn3610_firmware, Wcn3660b_firmware, Wcn3680b_firmware, Wcn3950_firmware, Wcn3980_firmware, Wcn3988_firmware, Wsa8810_firmware, Wsa8815_firmware, Wsa8830_firmware, Wsa8835_firmware
|
7.8
|
|
|
|
2023-08-08
|
CVE-2023-28576
|
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues.
|
Fastconnect_6800_firmware, Fastconnect_6900_firmware, Fastconnect_7800_firmware, Qca6391_firmware, Qca6426_firmware, Qca6436_firmware, Qcn9074_firmware, Qcs410_firmware, Qcs610_firmware, Sd865_5g_firmware, Snapdragon_865\+_5g_firmware, Snapdragon_865_5g_firmware, Snapdragon_870_5g_firmware, Snapdragon_8_gen_1_firmware, Snapdragon_x55_5g_firmware, Snapdragon_xr2_5g_firmware, Sw5100_firmware, Sw5100p_firmware, Sxr2130_firmware, Wcd9341_firmware, Wcd9370_firmware, Wcd9380_firmware, Wcn3660b_firmware, Wcn3680b_firmware, Wcn3950_firmware, Wcn3980_firmware, Wcn3988_firmware, Wsa8810_firmware, Wsa8815_firmware, Wsa8830_firmware, Wsa8835_firmware
|
7.0
|
|
|
|
2023-08-08
|
CVE-2023-28577
|
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.
|
Fastconnect_6800_firmware, Fastconnect_6900_firmware, Fastconnect_7800_firmware, Qca6391_firmware, Qca6426_firmware, Qca6436_firmware, Qcn9074_firmware, Qcs410_firmware, Qcs610_firmware, Sd865_5g_firmware, Snapdragon_865\+_5g_firmware, Snapdragon_865_5g_firmware, Snapdragon_870_5g_firmware, Snapdragon_8_gen_1_firmware, Snapdragon_x55_5g_firmware, Snapdragon_xr2_5g_firmware, Sw5100_firmware, Sw5100p_firmware, Sxr2130_firmware, Wcd9341_firmware, Wcd9370_firmware, Wcd9380_firmware, Wcn3660b_firmware, Wcn3680b_firmware, Wcn3950_firmware, Wcn3980_firmware, Wcn3988_firmware, Wsa8810_firmware, Wsa8815_firmware, Wsa8830_firmware, Wsa8835_firmware
|
7.8
|
|
|
|
2023-09-05
|
CVE-2022-33275
|
Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
|
315_5g_iot_modem_firmware, Apq5053\-Aa_firmware, Aqt1000_firmware, Ar8035_firmware, Ar9380_firmware, Csr8811_firmware, Csra6620_firmware, Csra6640_firmware, Csrb31024_firmware, Flight_rb5_5g_platform_firmware, Immersive_home_214_platform_firmware, Immersive_home_216_platform_firmware, Immersive_home_316_platform_firmware, Immersive_home_318_platform_firmware, Ipq4018_firmware, Ipq4028_firmware, Ipq4029_firmware, Ipq5010_firmware, Ipq5028_firmware, Ipq6000_firmware, Ipq6010_firmware, Ipq6018_firmware, Ipq6028_firmware, Ipq8064_firmware, Ipq8065_firmware, Ipq8068_firmware, Ipq8069_firmware, Ipq8070_firmware, Ipq8070a_firmware, Ipq8071_firmware, Ipq8071a_firmware, Ipq8072_firmware, Ipq8072a_firmware, Ipq8074_firmware, Ipq8074a_firmware, Ipq8076_firmware, Ipq8076a_firmware, Ipq8078_firmware, Ipq8078a_firmware, Ipq8173_firmware, Ipq8174_firmware, Ipq9008_firmware, Ipq9574_firmware, Pmp8074_firmware, Qam8295p_firmware, Qca1062_firmware, Qca1064_firmware, Qca2062_firmware, Qca2064_firmware, Qca2065_firmware, Qca2066_firmware, Qca4024_firmware, Qca6310_firmware, Qca6335_firmware, Qca6390_firmware, Qca6391_firmware, Qca6420_firmware, Qca6421_firmware, Qca6426_firmware, Qca6428_firmware, Qca6430_firmware, Qca6431_firmware, Qca6436_firmware, Qca6438_firmware, Qca6554a_firmware, Qca6564au_firmware, Qca6574_firmware, Qca6574a_firmware, Qca6574au_firmware, Qca6584au_firmware, Qca6595_firmware, Qca6595au_firmware, Qca6678aq_firmware, Qca6696_firmware, Qca6698aq_firmware, Qca8072_firmware, Qca8075_firmware, Qca8081_firmware, Qca8082_firmware, Qca8084_firmware, Qca8085_firmware, Qca8337_firmware, Qca8386_firmware, Qca9886_firmware, Qca9888_firmware, Qca9889_firmware, Qca9898_firmware, Qca9980_firmware, Qca9984_firmware, Qca9985_firmware, Qca9986_firmware, Qca9990_firmware, Qca9992_firmware, Qca9994_firmware, Qcm2290_firmware, Qcm4290_firmware, Qcm4325_firmware, Qcm4490_firmware, Qcm6490_firmware, Qcn5021_firmware, Qcn5022_firmware, Qcn5024_firmware, Qcn5052_firmware, Qcn5054_firmware, Qcn5122_firmware, Qcn5124_firmware, Qcn5152_firmware, Qcn5154_firmware, Qcn5164_firmware, Qcn6023_firmware, Qcn6024_firmware, Qcn6100_firmware, Qcn6102_firmware, Qcn6112_firmware, Qcn6122_firmware, Qcn6132_firmware, Qcn9000_firmware, Qcn9001_firmware, Qcn9002_firmware, Qcn9003_firmware, Qcn9011_firmware, Qcn9012_firmware, Qcn9022_firmware, Qcn9024_firmware, Qcn9070_firmware, Qcn9072_firmware, Qcn9074_firmware, Qcn9100_firmware, Qcn9274_firmware, Qcs2290_firmware, Qcs4290_firmware, Qcs4490_firmware, Qcs6490_firmware, Qcs8250_firmware, Qrb5165_firmware, Qrb5165m_firmware, Qrb5165n_firmware, Qsm8250_firmware, Qsm8350_firmware, Sa4150p_firmware, Sa6145p_firmware, Sa6150p_firmware, Sa6155_firmware, Sa6155p_firmware, Sa8145p_firmware, Sa8150p_firmware, Sa8155_firmware, Sa8155p_firmware, Sa8195p_firmware, Sa8295p_firmware, Sc7180\-Ac_firmware, Sc7180\-Ad_firmware, Sc8180x\+sdx55_firmware, Sc8180x\-Aa_firmware, Sc8180x\-Ab_firmware, Sc8180x\-Ac_firmware, Sc8180x\-Ad_firmware, Sc8180x\-Af_firmware, Sc8180xp\-Aa_firmware, Sc8180xp\-Ab_firmware, Sc8180xp\-Ac_firmware, Sc8180xp\-Ad_firmware, Sc8180xp\-Af_firmware, Sc8280xp\-Ab_firmware, Sc8280xp\-Bb_firmware, Sd460_firmware, Sd660_firmware, Sd662_firmware, Sd730_firmware, Sd855_firmware, Sd865_5g_firmware, Sd888_firmware, Sd_8cx_firmware, Sdm660_firmware, Sdx55_firmware, Sg4150p_firmware, Sm4125_firmware, Sm4250\-Aa_firmware, Sm4350\-Ac_firmware, Sm4350_firmware, Sm4375_firmware, Sm4450_firmware, Sm6150\-Ac_firmware, Sm6225\-Ad_firmware, Sm6225_firmware, Sm6250_firmware, Sm6250p_firmware, Sm6350_firmware, Sm6375_firmware, Sm7125_firmware, Sm7150\-Aa_firmware, Sm7150\-Ab_firmware, Sm7150\-Ac_firmware, Sm7225_firmware, Sm7250\-Aa_firmware, Sm7250\-Ab_firmware, Sm7250\-Ac_firmware, Sm7250p_firmware, Sm7315_firmware, Sm7325\-Ae_firmware, Sm7325\-Af_firmware, Sm7325p_firmware, Sm7350\-Ab_firmware, Sm8150\-Ac_firmware, Sm8150_firmware, Sm8250\-Ab_firmware, Sm8250\-Ac_firmware, Sm8250_firmware, Sm8350\-Ac_firmware, Sm8350_firmware, Sm8450_firmware, Sm8475_firmware, Snapdragon_662_mobile_platform_firmware, Snapdragon_675_mobile_platform_firmware, Snapdragon_750g_5g_mobile_platform_firmware, Snapdragon_7c\+_gen_3_compute_firmware, Snapdragon_ar2_gen_1_platform_firmware, Snapdragon_auto_4g_modem_firmware, Snapdragon_auto_5g_modem\-Rf_firmware, Snapdragon_w5\+_gen_1_wearable_platform_firmware, Snapdragon_x50_5g_modem\-Rf_system_firmware, Snapdragon_x55_5g_modem\-Rf_system_firmware, Snapdragon_x65_5g_modem\-Rf_system_firmware, Snapdragon_xr2\+_gen_1_platform_firmware, Snapdragon_xr2_5g_platform_firmware, Ssg2115p_firmware, Ssg2125p_firmware, Sw5100_firmware, Sw5100p_firmware, Sxr1230p_firmware, Sxr2130_firmware, Sxr2230p_firmware, Wcd9326_firmware, Wcd9335_firmware, Wcd9340_firmware, Wcd9341_firmware, Wcd9360_firmware, Wcd9370_firmware, Wcd9375_firmware, Wcd9380_firmware, Wcd9385_firmware, Wcn3910_firmware, Wcn3950_firmware, Wcn3980_firmware, Wcn3988_firmware, Wcn3990_firmware, Wcn3991_firmware, Wcn3998_firmware, Wcn6740_firmware, Wcn6750_firmware, Wcn685x\-1_firmware, Wcn685x\-5_firmware, Wcn785x\-1_firmware, Wcn785x\-5_firmware, Wsa8810_firmware, Wsa8815_firmware, Wsa8830_firmware, Wsa8832_firmware, Wsa8835_firmware
|
7.8
|
|
|
|
2023-09-05
|
CVE-2022-33220
|
Information disclosure in Automotive multimedia due to buffer over-read.
|
Aqt1000_firmware, Qam8295p_firmware, Qca6390_firmware, Qca6391_firmware, Qca6420_firmware, Qca6426_firmware, Qca6430_firmware, Qca6436_firmware, Qca6574au_firmware, Qca6595au_firmware, Qca6696_firmware, Qcc5100_firmware, Sa6145p_firmware, Sa6150p_firmware, Sa6155p_firmware, Sa8145p_firmware, Sa8150p_firmware, Sa8155p_firmware, Sa8195p_firmware, Sa8295p_firmware, Sd855_firmware, Sd865_5g_firmware, Sd870_firmware, Sd888_5g_firmware, Sd_8_gen1_5g_firmware, Sdx55m_firmware, Sdxr2_5g_firmware, Sw5100_firmware, Sw5100p_firmware, Wcd9341_firmware, Wcd9380_firmware, Wcd9385_firmware, Wcn3980_firmware, Wcn3988_firmware, Wcn3998_firmware, Wcn6850_firmware, Wcn6851_firmware, Wcn6855_firmware, Wcn6856_firmware, Wcn7850_firmware, Wcn7851_firmware, Wsa8810_firmware, Wsa8815_firmware, Wsa8830_firmware, Wsa8835_firmware
|
5.5
|
|
|
|
2023-09-05
|
CVE-2022-40524
|
Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.
|
Aqt1000_firmware, Qca6390_firmware, Qca6391_firmware, Qca6420_firmware, Qca6426_firmware, Qca6430_firmware, Qca6436_firmware, Qca6574au_firmware, Qca6595au_firmware, Qca6696_firmware, Qcc5100_firmware, Sa6145p_firmware, Sa6150p_firmware, Sa6155p_firmware, Sa8145p_firmware, Sa8150p_firmware, Sa8155p_firmware, Sa8195p_firmware, Sd855_firmware, Sd865_5g_firmware, Sd870_firmware, Sdx55m_firmware, Sdxr2_5g_firmware, Sw5100_firmware, Sw5100p_firmware, Wcd9341_firmware, Wcd9380_firmware, Wcn3660b_firmware, Wcn3680b_firmware, Wcn3980_firmware, Wcn3988_firmware, Wcn3998_firmware, Wcn6850_firmware, Wcn6851_firmware, Wsa8810_firmware, Wsa8815_firmware, Wsa8830_firmware, Wsa8835_firmware
|
7.8
|
|
|
|
2023-09-05
|
CVE-2023-21636
|
Memory Corruption due to improper validation of array index in Linux while updating adn record.
|
Aqt1000_firmware, Qca6390_firmware, Qca6391_firmware, Qca6420_firmware, Qca6426_firmware, Qca6430_firmware, Qca6436_firmware, Qca6574a_firmware, Qca6574au_firmware, Qca6595au_firmware, Qca6696_firmware, Qcc5100_firmware, Sa515m_firmware, Sa6145p_firmware, Sa6150p_firmware, Sa6155p_firmware, Sa8145p_firmware, Sa8150p_firmware, Sa8155p_firmware, Sa8195p_firmware, Sd480_firmware, Sd695_firmware, Sd855_firmware, Sd865_5g_firmware, Sd870_firmware, Sda429w_firmware, Sdx55_firmware, Sdx55m_firmware, Sdxr2_5g_firmware, Sm4375_firmware, Sw5100_firmware, Sw5100p_firmware, Wcd9341_firmware, Wcd9360_firmware, Wcd9370_firmware, Wcd9375_firmware, Wcd9380_firmware, Wcd9385_firmware, Wcn3610_firmware, Wcn3660b_firmware, Wcn3680b_firmware, Wcn3980_firmware, Wcn3988_firmware, Wcn3991_firmware, Wcn3998_firmware, Wcn6850_firmware, Wcn6851_firmware, Wsa8810_firmware, Wsa8815_firmware, Wsa8830_firmware, Wsa8835_firmware
|
7.8
|
|
|
|
2023-09-05
|
CVE-2022-40534
|
Memory corruption due to improper validation of array index in Audio.
|
Snapdragon_w5\+_gen_1_wearable_platform_firmware, Sw5100_firmware, Sw5100p_firmware, Sxr2230p_firmware, Wcd9380_firmware, Wcd9385_firmware, Wcn685x\-1_firmware, Wcn685x\-5_firmware, Wcn785x\-1_firmware, Wcn785x\-5_firmware, Wsa8830_firmware, Wsa8832_firmware, Wsa8835_firmware
|
7.8
|
|
|
|
2023-09-05
|
CVE-2023-21644
|
Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request.
|
Aqt1000_firmware, Qca6390_firmware, Qca6391_firmware, Qca6420_firmware, Qca6426_firmware, Qca6430_firmware, Qca6436_firmware, Qca6574a_firmware, Qca6574au_firmware, Qca6595au_firmware, Qca6696_firmware, Qcc5100_firmware, Sa515m_firmware, Sa6145p_firmware, Sa6150p_firmware, Sa6155p_firmware, Sa8145p_firmware, Sa8150p_firmware, Sa8155p_firmware, Sa8195p_firmware, Sd480_firmware, Sd695_firmware, Sd855_firmware, Sd865_5g_firmware, Sd870_firmware, Sda429w_firmware, Sdx55_firmware, Sdx55m_firmware, Sdxr2_5g_firmware, Sm4375_firmware, Sw5100_firmware, Sw5100p_firmware, Wcd9341_firmware, Wcd9360_firmware, Wcd9370_firmware, Wcd9375_firmware, Wcd9380_firmware, Wcd9385_firmware, Wcn3610_firmware, Wcn3660b_firmware, Wcn3680b_firmware, Wcn3980_firmware, Wcn3988_firmware, Wcn3991_firmware, Wcn3998_firmware, Wcn6850_firmware, Wcn6851_firmware, Wsa8810_firmware, Wsa8815_firmware, Wsa8830_firmware, Wsa8835_firmware
|
7.8
|
|
|
|
2023-09-05
|
CVE-2023-21646
|
Transient DOS in Modem while processing invalid System Information Block 1.
|
Ar8035_firmware, Qca6390_firmware, Qca6391_firmware, Qca6574a_firmware, Qca6595au_firmware, Qca6696_firmware, Qca8081_firmware, Qca8337_firmware, Qcm6490_firmware, Qcn6024_firmware, Qcn9024_firmware, Qcs6490_firmware, Qcx315_firmware, Sa515m_firmware, Sd480_firmware, Sd690_5g_firmware, Sd695_firmware, Sd765_firmware, Sd765g_firmware, Sd768g_firmware, Sd778g_firmware, Sd780g_firmware, Sd865_5g_firmware, Sd870_firmware, Sd888_5g_firmware, Sdx55_firmware, Sdx55m_firmware, Sdx65_firmware, Sdx70m_firmware, Sm4375_firmware, Sm7250p_firmware, Sm7325p_firmware, Sm8450_firmware, Wcd9341_firmware, Wcd9360_firmware, Wcd9370_firmware, Wcd9375_firmware, Wcd9380_firmware, Wcd9385_firmware, Wcn3988_firmware, Wcn3991_firmware, Wcn3998_firmware, Wcn6740_firmware, Wcn6750_firmware, Wcn6850_firmware, Wcn6851_firmware, Wcn6855_firmware, Wcn6856_firmware, Wcn7850_firmware, Wcn7851_firmware, Wsa8810_firmware, Wsa8815_firmware, Wsa8830_firmware, Wsa8835_firmware
|
7.5
|
|
|