Qualcomm ≫ Snapdragon Ar2 Gen 1 Firmware

Information disclosure while parsing the OCI IE with invalid length.

Memory corruption while power-up or power-down sequence of the camera sensor.

Memory corruption can occur in the camera when an invalid CID is used.

Memory corruption while configuring a Hypervisor based input virtual device.

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

Memory corruption while processing IOCTL call for getting group info.

Memory corruption when two threads try to map and unmap a single node simultaneously.

Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.

Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.