Qualcomm Ssg2125p Firmware

Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffer.

Transient DOS while parsing per STA profile in ML IE.

Memory corruption during memory mapping into protected VM address space due to incorrect API restrictions.

Memory corruption during memory assignment to headless peripheral VM due to incorrect error code handling.

Memory corruption in display driver while detaching a device.

Memory corruption may occur while validating ports and channels in Audio driver.

Information disclosure may occur due to improper permission and access controls to Video Analytics engine.

Memory corruption while handling multuple IOCTL calls from userspace for remote invocation.

Transient DOS during hypervisor virtual I/O operation in a virtual machine.

Information disclosure while deriving keys for a session for any Widevine use case.

Memory corruption during management frame processing due to mismatch in T2LM info element.

Information disclosure while parsing the OCI IE with invalid length.

Memory corruption while power-up or power-down sequence of the camera sensor.

Memory corruption can occur in the camera when an invalid CID is used.

Memory corruption while configuring a Hypervisor based input virtual device.

Memory corruption can occur when process-specific maps are added to the global list. If a map is removed from the global list while another thread is using it for a process-specific task, issues may arise.

Memory corruption while invoking IOCTL calls to unmap the DMA buffers.

Memory corruption when input parameter validation for number of fences is missing for fence frame IOCTL calls,

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.

Memory corruption when allocating and accessing an entry in an SMEM partition continuously.

Memory corruption while Configuring the SMR/S2CR register in Bypass mode.

Memory corruption while handling session errors from firmware.

Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.

Transient DOS while processing the CU information from RNR IE.

Transient DOS while parsing BTM ML IE when per STA profile is not included.