Qualcomm Snapdragon Xr2 5G vulnerabilities, page 4
96 vulnerabilities
Known vulnerabilities in Qualcomm Snapdragon Xr2 5G, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2023-43529qualcomm, inc.snapdragon+154
EPSS score0.32%
Transient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.CVE-2023-43549qualcomm, inc.snapdragon+136EPSS score0.11%
Memory corruption while processing TPC target power table in FTM TPC.CVE-2023-43530qualcomm, inc.snapdragon+154EPSS score0.11%
Memory corruption in HLOS while checking for the storage type.CVE-2023-43531qualcomm, inc.snapdragon+124EPSS score0.11%
Memory corruption while verifying the serialized header when the key pairs are generated.CVE-2023-43528qualcomm, inc.snapdragon+90EPSS score0.11%
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.CVE-2023-43539qualcomm, inc.snapdragon+135EPSS score0.32%
Transient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.CVE-2023-43538qualcomm, inc.snapdragon+133EPSS score0.10%
Memory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.CVE-2023-22387qualcomm, inc.snapdragon+266EPSS score0.12%
Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption.CVE-2023-22386qualcomm, inc.snapdragon+196EPSS score0.12%
Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory.CVE-2023-22667qualcomm, inc.snapdragon+200EPSS score0.12%
Memory Corruption in Audio while allocating the ion buffer during the music playback.CVE-2023-24854qualcomm, inc.snapdragon+158EPSS score0.12%
Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.CVE-2023-24851qualcomm, inc.snapdragon+186EPSS score0.12%
Memory Corruption in WLAN HOST while parsing QMI response message from firmware.CVE-2023-28575qualcomm, inc.snapdragon+59EPSS score0.12%
The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.CVE-2023-28576qualcomm, inc.snapdragon+30EPSS score0.08%
The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel code to be invalid. This may lead to out-of-bounds read/write issues.CVE-2023-28577qualcomm, inc.snapdragon+30EPSS score0.12%
In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause UAF of the kernel address.CVE-2023-28541qualcomm, inc.snapdragon+198EPSS score0.12%
Memory Corruption in Data Modem while processing DMA buffer release event about CFR data.CVE-2023-28573qualcomm, inc.snapdragon+195EPSS score0.12%
Memory corruption in WLAN HAL while parsing WMI command parameters.CVE-2023-28547qualcomm, inc.snapdragon+295EPSS score0.11%
Memory corruption in SPS Application while requesting for public key in sorter TA.CVE-2023-28578qualcomm, inc.snapdragon+333EPSS score0.12%
Memory corruption in Core Services while executing the command for removing a single event listener.CVE-2023-28542qualcomm, inc.snapdragon+183EPSS score0.12%
Memory Corruption in WLAN HOST while fetching TX status information.