Known Vulnerabilities
CVE-2024-45558
Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.
CVE-2024-33056
Memory corruption when allocating and accessing an entry in an SMEM partition continuously.
CVE-2024-33073
Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
CVE-2024-33066
Memory corruption while redirecting log file to any file location with any file name.
CVE-2024-33049
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
CVE-2024-33057
Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
CVE-2024-33050
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
CVE-2024-33048
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
CVE-2024-33016
memory corruption when an invalid firehose patch command is invoked.
CVE-2024-33026
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
CVE-2024-33025
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.
CVE-2024-33024
Transient DOS while parsing the ML IE when a beacon with length field inside the common info of ML IE greater than the ML IE length.
CVE-2024-33019
Transient DOS while parsing the received TID-to-link mapping action frame.
CVE-2024-33018
Transient DOS while parsing the received TID-to-link mapping element of the TID-to-link mapping action frame.
CVE-2024-33015
Transient DOS while parsing SCAN RNR IE when bytes received from AP is such that the size of the last param of IE is less than neighbor report.
CVE-2024-33014
Transient DOS while parsing ESP IE from beacon/probe response frame.
CVE-2024-33013
Transient DOS when driver accesses the ML IE memory and offset value is incremented beyond ML IE length.
CVE-2024-33012
Transient DOS while parsing the multiple MBSSID IEs from the beacon, when the tag length is non-zero value but with end of beacon.
CVE-2024-33011
Transient DOS while parsing the MBSSID IE from the beacons, when the MBSSID IE length is zero.
CVE-2024-33010
Transient DOS while parsing fragments of MBSSID IE from beacon frame.
CVE-2024-21467
Information disclosure while handling beacon probe frame during scan entry generation in client side.
CVE-2024-21459
Information disclosure while handling beacon or probe response frame in STA.
CVE-2024-23368
Memory corruption when allocating and accessing an entry in an SMEM partition.
CVE-2024-21482
Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.
CVE-2024-21462
Transient DOS while loading the TA ELF file.
CVE-2024-21458
Information disclosure while handling SA query action frame.
CVE-2024-21457
INformation disclosure while handling Multi-link IE in beacon frame.
CVE-2024-23363
Transient DOS while processing an improperly formatted Fine Time Measurement (FTM) management frame.
CVE-2023-43537
Information disclosure while handling T2LM Action Frame in WLAN Host.
CVE-2024-21477
Transient DOS while parsing a protected 802.11az Fine Time Measurement (FTM) frame.
CVE-2024-21473
Memory corruption while redirecting log file to any file location with any file name.
CVE-2023-43553
Memory corruption while parsing beacon/probe response frame when AP sends more supported links in MLIE.
CVE-2023-43552
Memory corruption while processing MBSSID beacon containing several subelement IE.
CVE-2023-43549
Memory corruption while processing TPC target power table in FTM TPC.
CVE-2023-43539
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.
CVE-2023-33105
Transient DOS in WLAN Host and Firmware when large number of open authentication frames are sent with an invalid transaction sequence number.
CVE-2023-28578
Memory corruption in Core Services while executing the command for removing a single event listener.
CVE-2023-43536
Transient DOS while parse fils IE with length equal to 1.
CVE-2023-43523
Transient DOS while processing 11AZ RTT management action frame received through OTA.
CVE-2023-43522
Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL.
CVE-2023-43513
Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.
CVE-2023-33060
Transient DOS in Core when DDR memory check is called while DDR is not initialized.
CVE-2023-43511
Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header.
CVE-2023-33116
Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
CVE-2023-33112
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
CVE-2023-33109
Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
CVE-2023-33062
Transient DOS in WLAN Firmware while parsing a BTM request.
CVE-2023-33032
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
CVE-2023-33030
Memory corruption in HLOS while running playready use-case.
CVE-2023-33098
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
CVE-2023-33097
Transient DOS in WLAN Firmware while processing a FTMR frame.
CVE-2023-33089
Transient DOS when processing a NULL buffer while parsing WLAN vdev.
CVE-2023-33088
Memory corruption when processing cmd parameters while parsing vdev.
CVE-2023-33083
Memory corruption in WLAN Host while processing RRM beacon on the AP.
CVE-2023-33082
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
CVE-2023-33081
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
CVE-2023-33080
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
CVE-2023-33063
Memory corruption in DSP Services during a remote call from HLOS to DSP.
CVE-2023-33053
Memory corruption in Kernel while parsing metadata.
CVE-2023-33041
Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
CVE-2023-28586
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
CVE-2023-28585
Memory corruption while loading an ELF segment in TEE Kernel.
CVE-2023-28550
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
CVE-2023-33061
Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame.
CVE-2023-33056
Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE.
CVE-2023-33048
Transient DOS in WLAN Firmware while parsing t2lm buffers.
CVE-2023-33047
Transient DOS in WLAN Firmware while parsing no-inherit IES.
CVE-2023-33045
Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute.
CVE-2023-28569
Information disclosure in WLAN HAL while handling command through WMI interfaces.
CVE-2023-28563
Information disclosure in IOE Firmware while handling WMI command.
CVE-2023-28554
Information Disclosure in Qualcomm IPC while reading values from shared memory in VM.
CVE-2023-28553
Information Disclosure in WLAN Host when processing WMI event command.
CVE-2023-24852
Memory Corruption in Core due to secure memory access by user while loading modem image.
CVE-2023-33028
Memory corruption in WLAN Firmware while doing a memory copy of pmk cache.
CVE-2023-33027
Transient DOS in WLAN Firmware while parsing rsn ies.
CVE-2023-33026
Transient DOS in WLAN Firmware while parsing a NAN management frame.
CVE-2023-28539
Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.
CVE-2023-24847
Transient DOS in Modem while allocating DSM items.
CVE-2023-33016
Transient DOS in WLAN firmware while parsing MLO (multi-link operation).
CVE-2023-33015
Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame.
CVE-2023-28573
Memory corruption in WLAN HAL while parsing WMI command parameters.
CVE-2023-28567
Memory corruption in WLAN HAL while handling command through WMI interfaces.
CVE-2023-28565
Memory corruption in WLAN HAL while handling command streams through WMI interfaces.
CVE-2023-28564
Memory corruption in WLAN HAL while passing command parameters through WMI interfaces.
CVE-2023-28560
Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
CVE-2023-28559
Memory corruption in WLAN FW while processing command parameters from untrusted WMI payload.
CVE-2023-28557
Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload.
CVE-2023-28549
Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload.
CVE-2023-28548
Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART.
CVE-2023-28544
Memory corruption in WLAN while sending transmit command from HLOS to UTF handlers.
CVE-2022-33275
Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
CVE-2023-21625
Information disclosure in Network Services due to buffer over-read while the device receives DNS response.
CVE-2023-28541
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.
CVE-2023-24854
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.
CVE-2023-24851
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.
CVE-2023-22387
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.
CVE-2023-22386
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.
CVE-2023-21661
Transient DOS while parsing WLAN beacon or probe-response frame.
CVE-2023-21660
Transient DOS in WLAN Firmware while parsing FT Information Elements.
CVE-2023-21659
Transient DOS in WLAN Firmware while processing frames with missing header fields.
CVE-2023-21658
Transient DOS in WLAN Firmware while processing the received beacon or probe response frame.
CVE-2023-21628
Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command.
CVE-2022-40525
Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis.
CVE-2022-40522
Memory corruption in Linux Networking due to double free while handling a hyp-assign.
CVE-2022-22076
information disclosure due to cryptographic issue in Core during RPMB read request.
CVE-2022-33304
Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.
CVE-2022-40532
Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
CVE-2022-33291
Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
CVE-2022-33287
Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
CVE-2022-40535
Transient DOS due to buffer over-read in WLAN while sending a packet to device.
CVE-2022-40531
Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
CVE-2022-40530
Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.
CVE-2022-40527
Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.
CVE-2022-33309
Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.
CVE-2022-25655
Memory corruption in WLAN HAL while arbitrary value is passed in WMI UTF command payload.
CVE-2022-40514
Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.
CVE-2022-40513
Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state.
CVE-2022-40512
Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
CVE-2022-40502
Transient DOS due to improper input validation in WLAN Host.
CVE-2022-34146
Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation.
CVE-2022-34145
Transient DOS due to buffer over-read in WLAN Host while parsing frame information.
CVE-2022-33306
Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.
CVE-2022-33279
Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length.
CVE-2022-33277
Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.
CVE-2022-33271
Information disclosure due to buffer over-read in WLAN while parsing NMF frame.
CVE-2022-33243
Memory corruption due to improper access control in Qualcomm IPC.
CVE-2022-33229
Information disclosure due to buffer over-read in Modem while using static array to process IPv4 packets.
CVE-2022-25738
Information disclosure in modem due to buffer over-red while performing checksum of packet received
CVE-2022-25735
Denial of service in modem due to missing null check while processing TCP or UDP packets from server
CVE-2022-25734
Denial of service in modem due to missing null check while processing IP packets with padding
CVE-2022-25733
Denial of service in modem due to null pointer dereference while processing DNS packets
CVE-2022-25732
Information disclosure in modem due to buffer over read in dns client due to missing length check
CVE-2022-25729
Memory corruption in modem due to improper length check while copying into memory
CVE-2022-25728
Information disclosure in modem due to buffer over-read while processing response from DNS server
CVE-2022-40519
Information disclosure due to buffer overread in Core
CVE-2022-40517
Memory corruption in core due to stack-based buffer overflow
CVE-2022-40516
Memory corruption in Core due to stack-based buffer overflow.
CVE-2022-33286
Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
CVE-2022-33285
Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
CVE-2022-33284
Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.
CVE-2022-33283
Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.
CVE-2022-33276
Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command.
CVE-2022-33253
Transient DOS due to buffer over-read in WLAN while parsing corrupted NAN frames.
CVE-2022-33252
Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.
CVE-2022-25722
Information exposure in DSP services due to improper handling of freeing memory