Qualcomm products with Android releases from CAF using the Linux kernel vulnerabilities

In Qualcomm products with Android releases from CAF, during DMA allocation, due to wrong data type of size, allocation size gets truncated which makes allocation succeed when it should fail.

In Qualcomm products with Android releases from CAF using the Linux kernel, user-level permissions can be used to gain access to kernel memory. Specifically, the ION cache maintenance code is writing to a user supplied address.

In Qualcomm products with Android releases from CAF, in function msm_compr_ioctl_shared, the variable 'ddp->params_length' could be accessed and modified by multiple threads without proper protection. This can lead to race conditions and buffer overflow if the variable is set to a large value.

In Qualcomm products with Android releases from CAF, in the function msm_dba_register_client, there is an issue where if client registration fails, the client is freed but not removed from the list. This can lead to a use-after-free situation when traversing the list next time.

In Qualcomm products with Android releases from CAF, user controlled variables 'nr_cmds' and 'nr_bos' are passed across functions without any checks. This may lead to buffer overflow when the values are too large or negative.

In Qualcomm products with Android releases from CAF, there is an issue with multiple threads performing the device open operation. This may lead to get_pid being called multiple times, while put_pid is called only once.

All Qualcomm products with Android releases from CAF using the Linux kernel may be susceptible to memory corruption. This issue occurs during concurrent calls into ioctl RMNET_IOCTL_ADD_MUX_CHANNEL in the ipa wan driver due to missing locks.

All Qualcomm products with Android releases from CAF using the Linux kernel may leak kernel memory contents to system logs if a userspace string is not NULL-terminated.

In Qualcomm products with Android releases from CAF, in some memory allocation and free functions, a race condition can potentially occur leading to a Use After Free condition.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue with improper type downcasting, which may lead to a value improperly passing validation and causing an out of bounds write later.

In Qualcomm products with Android releases from CAF using the Linux kernel, there is an issue with the sde_rotator debug interface. When multiple processes access this interface for register reading, one process can free the debug buffer while another process is still using it.

In Qualcomm products with Android releases from CAF using the Linux kernel, array out of bounds access can occur if userspace sends more than 16 multicast addresses.

All Qualcomm products with Android releases from CAF using the Linux kernel have an integer overflow vulnerability in boot.

In Qualcomm products with Android releases from CAF using the Linux kernel, there is a potential for kernel memory to be overwritten if an invalid master is sent from userspace.

In Qualcomm products with Android releases from CAF using the Linux kernel, there is no size check for the images being flashed onto the NAND memory in their respective partitions. This may lead to writing beyond the intended partition.

All Qualcomm products with Android releases from CAF using the Linux kernel have a TOCTOU race condition in Secure UI.

In the service locator in Qualcomm products with Android releases from CAF, a buffer overflow vulnerability exists. This issue arises because the variable set to determine the buffer size is not used to indicate the actual size of the buffer.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue with improper validation of arguments in several QTEE syscalls.

All Qualcomm products with Android releases from CAF using the Linux kernel may have an issue with a driver that can potentially leak kernel memory.

All Qualcomm products with Android releases from CAF using the Linux kernel may consume excessive amounts of memory when downloading a file.

All Qualcomm products with Android releases from CAF using the Linux kernel have a configuration vulnerability when loading a 3rd-party QTEE application.

All Qualcomm products with Android releases from CAF using the Linux kernel have an integer overflow vulnerability in the hypervisor.

All Qualcomm products with Android releases from CAF using the Linux kernel may be vulnerable to the use of an out-of-range pointer offset in LTE.

In Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.

In Qualcomm products with Android releases from CAF using the Linux kernel, an untrusted pointer dereference can occur in a TrustZone syscall.

All Qualcomm products with Android releases from CAF using the Linux kernel have a buffer over-read vulnerability in a TrustZone syscall.

All Qualcomm products with Android releases from CAF using the Linux kernel have a buffer over-read vulnerability in a TrustZone syscall.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue with improper validation of an argument in the mink syscall.

All Qualcomm products with Android releases from CAF using the Linux kernel have a potential vulnerability related to compiler optimization of the memset() function.

All Qualcomm products with Android releases from CAF using the Linux kernel have a buffer overflow vulnerability in an Inter-RAT procedure.

All Qualcomm products with Android releases from CAF using the Linux kernel have a vulnerability that allows a UE to respond to a UEInformationRequest before Access Stratum security is established.

All Qualcomm products with Android releases from CAF using the Linux kernel can send IMEI or IMEISV to the network on a network request before NAS security has been activated.

All Qualcomm products with Android releases from CAF using the Linux kernel have a buffer overflow vulnerability in a procedure involving a remote UIM client.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue with PlayReady DRM that fails to check a length, potentially leading to unauthorized access to secure memory.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue with improper pointer validation in a QTEE system call.

All Qualcomm products with Android releases from CAF using the Linux kernel may have a potentially reachable assertion in a memory management routine.

All Qualcomm products with Android releases from CAF using the Linux kernel have a vulnerability in LTE where an assertion can be reached while processing a downlink message.

All Qualcomm products with Android releases from CAF using the Linux kernel have a vulnerability in LTE where an assertion can be reached due to an improper bound on a length in a System Information message.

All Qualcomm products with Android releases from CAF using the Linux kernel have a vulnerability in the processing of certain responses from the USIM.

All Qualcomm products with Android releases from CAF using the Linux kernel have a vulnerability in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.

All Qualcomm products with Android releases from CAF using the Linux kernel have a vulnerability in GERAN where a buffer can be overflown while taking power measurements.

All Qualcomm products with Android releases from CAF using the Linux kernel have a vulnerability in LTE where an assertion can be reached due to an improper bound on the size of a frequency list.

All Qualcomm products with Android releases from CAF using the Linux kernel may be susceptible to buffer over-read during the processing of a downlink 3G NAS message.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue with an incorrect length used to clear a memory buffer, resulting in adjacent memory getting corrupted.

All Qualcomm products with Android releases from CAF using the Linux kernel have an issue with failing to free a memory buffer after it is no longer needed, potentially leading to memory exhaustion.

All Qualcomm products with Android releases from CAF using the Linux kernel may have an issue with a string failing to be null-terminated in SIP, leading to a buffer overflow.

All Qualcomm products with Android releases from CAF using the Linux kernel have a buffer over-read vulnerability in digital television/digital radio DRM.

All Qualcomm products with Android releases from CAF using the Linux kernel have a buffer overflow vulnerability in 1x call processing.

All Qualcomm products with Android releases from CAF using the Linux kernel have a Sample App that fails to check a length, potentially leading to unauthorized access to secure memory.

All Qualcomm products with Android releases from CAF using the Linux kernel have an uninitialized variable in a TrustZone system call, potentially leading to the compromise of secure memory.