Qualcomm
Page 5 of 26 — Qualcomm CVEs from a corpus of 2538, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-43064 | High | 7.5 | 2025-01-06 | Uncontrolled resource consumption when a driver, an application or a SMMU client tries to access the global registers through SMMU. |
CVE-2024-43063 | Medium | 6.1 | 2025-01-06 | information disclosure while invoking the mailbox read API. |
CVE-2024-33067 | Medium | 6.1 | 2025-01-06 | Information disclosure while invoking callback function of sound model driver from ADSP for every valid opcode received from sound model driver. |
CVE-2024-33061 | Medium | 6.8 | 2025-01-06 | Information disclosure while processing IOCTL call made for releasing a trusted VM process release or opening a channel without initializing the process. |
CVE-2024-33059 | Medium | 6.7 | 2025-01-06 | Memory corruption while processing frame command IOCTL calls. |
CVE-2024-33055 | Medium | 6.7 | 2025-01-06 | Memory corruption while invoking IOCTL calls to unmap the DMA buffers. |
CVE-2024-33041 | Medium | 6.7 | 2025-01-06 | Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls, |
CVE-2024-23366 | Medium | 6.6 | 2025-01-06 | Information Disclosure while invoking the mailbox write API when message received from user is larger than mailbox size. |
CVE-2024-21464 | High | 8.4 | 2025-01-06 | Memory corruption while processing IPA statistics, when there are no active clients registered. |
CVE-2024-43053 | High | 7.8 | 2024-12-02 | Memory corruption while invoking IOCTL calls from user space to read WLAN target diagnostic information. |
CVE-2024-43052 | High | 7.8 | 2024-12-02 | Memory corruption while processing API calls to NPU with invalid input. |
CVE-2024-43050 | High | 7.8 | 2024-12-02 | Memory corruption while invoking IOCTL calls from user space to issue factory test command inside WLAN driver. |
CVE-2024-43049 | High | 7.8 | 2024-12-02 | Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver. |
CVE-2024-43048 | High | 7.8 | 2024-12-02 | Memory corruption when invalid input is passed to invoke GPU Headroom API call. |
CVE-2024-33063 | High | 7.5 | 2024-12-02 | Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present. |
CVE-2024-33056 | High | 8.4 | 2024-12-02 | Memory corruption when allocating and accessing an entry in an SMEM partition continuously. |
CVE-2024-33053 | Medium | 6.7 | 2024-12-02 | Memory corruption when multiple threads try to unregister the CVP buffer at the same time. |
CVE-2024-33044 | High | 8.4 | 2024-12-02 | Memory corruption while Configuring the SMR/S2CR register in Bypass mode. |
CVE-2024-33040 | Medium | 6.7 | 2024-12-02 | Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer rel… |
CVE-2024-33039 | Medium | 6.7 | 2024-12-02 | Memory corruption when PAL client calls PAL service APIs by passing a random value as handle and the handle is not validated by the service. |
CVE-2024-33037 | Medium | 6.1 | 2024-12-02 | Information disclosure as NPU firmware can send invalid IPC message to NPU driver as the driver doesn`t validate the IPC message received from the firmware. |
CVE-2024-33036 | Medium | 6.7 | 2024-12-02 | Memory corruption while parsing sensor packets in camera driver, user-space variable is used while allocating memory in kernel and parsing which can lead to hu… |
CVE-2018-5852 | High | 8.4 | 2024-11-26 | An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/i… |
CVE-2018-11816 | High | 7.8 | 2024-11-26 | Crafted Binder Request Causes Heap UAF in MediaServer |
CVE-2017-18307 | High | 8.4 | 2024-11-26 | Information disclosure possible while audio playback. |
CVE-2017-18306 | High | 8.4 | 2024-11-26 | Information disclosure due to uninitialized variable. |
CVE-2016-10408 | High | 8.4 | 2024-11-26 | QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable m… |
CVE-2018-11952 | High | 8.4 | 2024-11-26 | An image with a version lower than the fuse version may potentially be booted lead to improper authentication. |
CVE-2018-11922 | Critical | 9.8 | 2024-11-26 | Wrong configuration in Touch Pal application can collect user behavior data without awareness by the user. |
CVE-2017-18153 | High | 8.4 | 2024-11-26 | A race condition exists in a driver potentially leading to a use-after-free condition. |
CVE-2017-17772 | Critical | 9.8 | 2024-11-26 | In multiple functions that process 802.11 frames, out-of-bounds reads can occur due to insufficient validation. |
CVE-2017-15832 | High | 8.4 | 2024-11-26 | Buffer overwrite in the WLAN host driver by leveraging a compromised WLAN FW |
CVE-2017-11076 | Critical | 9.8 | 2024-11-26 | On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to a… |
CVE-2016-10394 | High | 8.4 | 2024-11-26 | Initial xbl_sec revision does not have all the debug policy features and critical checks. |
CVE-2021-30299 | Medium | 6.7 | 2024-11-22 | Possible out of bound access in audio module due to lack of validation of user provided input. |
CVE-2017-9711 | Medium | 6.7 | 2024-11-22 | Certain unprivileged processes are able to perform IOCTL calls. |
CVE-2024-38424 | High | 7.8 | 2024-11-04 | Memory corruption during GNSS HAL process initialization. |
CVE-2024-38423 | High | 7.8 | 2024-11-04 | Memory corruption while processing GPU page table switch. |
CVE-2024-38422 | High | 7.8 | 2024-11-04 | Memory corruption while processing voice packet with arbitrary data received from ADSP. |
CVE-2024-38421 | High | 7.8 | 2024-11-04 | Memory corruption while processing GPU commands. |
CVE-2024-38419 | High | 7.8 | 2024-11-04 | Memory corruption while invoking IOCTL calls from the use-space for HGSL memory node. |
CVE-2024-38415 | High | 7.8 | 2024-11-04 | Memory corruption while handling session errors from firmware. |
CVE-2024-38410 | High | 7.8 | 2024-11-04 | Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice. |
CVE-2024-38409 | High | 7.8 | 2024-11-04 | Memory corruption while station LL statistic handling. |
CVE-2024-38408 | High | 8.2 | 2024-11-04 | Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. |
CVE-2024-38407 | High | 7.8 | 2024-11-04 | Memory corruption while processing input parameters for any IOCTL call in the JPEG Encoder driver. |
CVE-2024-38406 | High | 7.8 | 2024-11-04 | Memory corruption while handling IOCTL calls in JPEG Encoder driver. |
CVE-2024-38405 | High | 7.5 | 2024-11-04 | Transient DOS while processing the CU information from RNR IE. |
CVE-2024-38403 | High | 7.5 | 2024-11-04 | Transient DOS while parsing BTM ML IE when per STA profile is not included. |
CVE-2024-33068 | High | 7.5 | 2024-11-04 | Transient DOS while parsing fragments of MBSSID IE from beacon frame. |
CVE-2024-33033 | Medium | 6.7 | 2024-11-04 | Memory corruption while processing IOCTL calls to unmap the buffers. |
CVE-2024-33032 | Medium | 6.7 | 2024-11-04 | Memory corruption when the user application modifies the same shared memory asynchronously when kernel is accessing it. |
CVE-2024-33031 | Medium | 6.7 | 2024-11-04 | Memory corruption while processing the update SIM PB records request. |
CVE-2024-33030 | Medium | 6.7 | 2024-11-04 | Memory corruption while parsing IPC frequency table parameters for LPLH that has size greater than expected size. |
CVE-2024-33029 | Medium | 6.7 | 2024-11-04 | Memory corruption while handling the PDR in driver for getting the remote heap maps. |
CVE-2024-23386 | Medium | 6.7 | 2024-11-04 | memory corruption when WiFi display APIs are invoked with large random inputs. |
CVE-2024-23385 | High | 7.5 | 2024-11-04 | Transient DOS as modem reset occurs when an unexpected MAC RAR (with invalid PDU length) is seen at UE. |
CVE-2024-23377 | Medium | 6.7 | 2024-11-04 | Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been… |
CVE-2024-43047 | High | 7.8 | 2024-10-07 | Memory corruption while maintaining memory maps of HLOS memory. |
CVE-2024-38425 | Medium | 6.1 | 2024-10-07 | Information disclosure while sending implicit broadcast containing APP launch information. |
CVE-2024-38399 | High | 8.4 | 2024-10-07 | Memory corruption while processing user packets to generate page faults. |
CVE-2024-38397 | High | 7.5 | 2024-10-07 | Transient DOS while parsing probe response and assoc response frame. |
CVE-2024-33073 | High | 8.2 | 2024-10-07 | Information disclosure while parsing the BSS parameter change count or MLD capabilities fields of the ML IE. |
CVE-2024-33071 | High | 7.5 | 2024-10-07 | Transient DOS while parsing the MBSSID IE from the beacons when IE length is 0. |
CVE-2024-33070 | High | 7.5 | 2024-10-07 | Transient DOS while parsing ESP IE from beacon/probe response frame. |
CVE-2024-33069 | High | 7.5 | 2024-10-07 | Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host. |
CVE-2024-33066 | Critical | 9.8 | 2024-10-07 | Memory corruption while redirecting log file to any file location with any file name. |
CVE-2024-33065 | High | 8.4 | 2024-10-07 | Memory corruption while taking snapshot when an offset variable is set by camera driver. |
CVE-2024-33064 | High | 8.2 | 2024-10-07 | Information disclosure while parsing the multiple MBSSID IEs from the beacon. |
CVE-2024-33049 | High | 7.5 | 2024-10-07 | Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame. |
CVE-2024-23379 | Medium | 6.7 | 2024-10-07 | Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario. |
CVE-2024-23378 | Medium | 6.7 | 2024-10-07 | Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record. |
CVE-2024-23376 | Medium | 6.7 | 2024-10-07 | Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call. |
CVE-2024-23375 | Medium | 6.7 | 2024-10-07 | Memory corruption during the network scan request. |
CVE-2024-23374 | Medium | 6.7 | 2024-10-07 | Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file. |
CVE-2024-23370 | Medium | 6.7 | 2024-10-07 | Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the sam… |
CVE-2024-23369 | High | 7.8 | 2024-10-07 | Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers. |
CVE-2024-21455 | High | 7.8 | 2024-10-07 | Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver. |
CVE-2024-38402 | High | 7.8 | 2024-09-02 | Memory corruption while processing IOCTL call for getting group info. |
CVE-2024-38401 | High | 7.8 | 2024-09-02 | Memory corruption while processing concurrent IOCTL calls. |
CVE-2024-33060 | High | 8.4 | 2024-09-02 | Memory corruption when two threads try to map and unmap a single node simultaneously. |
CVE-2024-33057 | High | 7.5 | 2024-09-02 | Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location. |
CVE-2024-33054 | High | 7.8 | 2024-09-02 | Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine. |
CVE-2024-33052 | High | 7.8 | 2024-09-02 | Memory corruption when user provides data for FM HCI command control operations. |
CVE-2024-33051 | High | 7.5 | 2024-09-02 | Transient DOS while processing TIM IE from beacon frame as there is no check for IE length. |
CVE-2024-33050 | High | 7.5 | 2024-09-02 | Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper. |
CVE-2024-33048 | High | 7.5 | 2024-09-02 | Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame. |
CVE-2024-33047 | High | 8.4 | 2024-09-02 | Memory corruption when the captureRead QDCM command is invoked from user-space. |
CVE-2024-33045 | High | 8.4 | 2024-09-02 | Memory corruption when BTFM client sends new messages over Slimbus to ADSP. |
CVE-2024-33043 | Medium | 5.5 | 2024-09-02 | Transient DOS while handling PS event when Program Service name length offset value is set to 255. |
CVE-2024-33042 | High | 7.8 | 2024-09-02 | Memory corruption when Alternative Frequency offset value is set to 255. |
CVE-2024-33038 | High | 7.8 | 2024-09-02 | Memory corruption while passing untrusted/corrupted pointers from DSP to EVA. |
CVE-2024-33035 | High | 8.4 | 2024-09-02 | Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients. |
CVE-2024-33016 | Medium | 6.8 | 2024-09-02 | memory corruption when an invalid firehose patch command is invoked. |
CVE-2024-23365 | High | 8.4 | 2024-09-02 | Memory corruption while releasing shared resources in MinkSocket listener thread. |
CVE-2024-23364 | High | 7.5 | 2024-09-02 | Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is recei… |
CVE-2024-23362 | High | 7.1 | 2024-09-02 | Cryptographic issue while parsing RSA keys in COBR format. |
CVE-2024-23359 | High | 8.2 | 2024-09-02 | Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network. |
CVE-2024-23358 | High | 7.5 | 2024-09-02 | Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem. |
CVE-2024-33034 | High | 8.4 | 2024-08-05 | Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at t… |