Qualcomm ≫ Wcn3988 Firmware

Memory corruption while power-up or power-down sequence of the camera sensor.

Information disclosure while parsing the OCI IE with invalid length.

Memory corruption while processing IOCTL from user space to handle GPU AHB bus error.

Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.

Information disclosure while processing information on firmware image during core initialization.

Information disclosure while processing IO control commands.

Memory corruption while parsing the memory map info in IOCTL calls.

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

Transient DOS can occur when the driver parses the per STA profile IE and tries to access the EXTN element ID without checking the IE length.

Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process.