Chengjia4574

O problema está relacionado à função `stex queuecommand lck()` no kernel Linux, que está associada à divulgação de informações em uma área de dados de erro. Isso pode permitir que um invasor obtenha acesso não autorizado a informações protegidas. O problema surge porque `stex queuecommand lck` não possui um `memset` para o caso `PASSTHRU CMD`, permitindo que usuários locais obtenham informações confidenciais da memória do kernel.

O problema decorre do processamento do algoritmo DCB/AVB com um índice de fila inválido proveniente de uma solicitação IOCTL, o que pode levar à modificação arbitrária de endereços. Isso afeta vários produtos Snapdragon, incluindo Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IoT, Snapdragon Industrial IoT, Snapdragon Mobile e Snapdragon Voice & Music.

O problema está relacionado a uma possível gravação fora dos limites devido à validação inadequada do número de valores de temporizador recebidos do firmware durante a sincronização dos temporizadores. Isso afeta vários produtos Qualcomm Snapdragon, incluindo Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IoT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure e Networking.

**Nome do software vulnerável e versões afetadas: Qualcomm Snapdragon (versões afetadas não especificadas) Descrição: O problema está relacionado a uma possível leitura excessiva do buffer devido à validação inadequada de um ponteiro de dados durante a análise do indicador FILS. Isso afeta vários produtos Qualcomm Snapdragon, incluindo Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IoT, Snapdragon Industrial IoT, Snapdragon Mobile e Snapdragon Wired Infrastructure and Networking. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

O problema decorre da falta de validação do tamanho da carga útil antes da leitura da memória, o que pode levar ao acesso a ponteiros inválidos ou dados inválidos. Isso afeta vários produtos Qualcomm Snapdragon, incluindo Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IoT, Snapdragon Industrial IoT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables e Snapdragon Wired Infrastructure and Networking.

The issue is related to an elevation of privilege vulnerability in the NVIDIA firmware processing code, affecting the Android kernel.

The issue arises from concurrent calls into `ioctl RMNET IOCTL ADD MUX CHANNEL` in the ipa wan driver, which may lead to memory corruption due to missing locks.

The issue concerns corruption of kernel memory due to a write to a PCIe register using a debugfs node.

A race condition exists in a driver of the Linux kernel used in Qualcomm products with Android releases from CAF, potentially leading to a use-after-free condition.

The issue is related to an elevation of privilege vulnerability in the MediaTek sound driver, which could allow a local malicious application to execute arbitrary code within the context of the kernel. This vulnerability is rated as Moderate because it first requires compromising a privileged process and due to vulnerability-specific details that limit the impact of the issue. The vulnerability is associated with inadequate access control in the MediaTek sound driver, potentially allowing an attacker to elevate their privileges and execute arbitrary code in the kernel context using a local malicious application.

The issue is related to an elevation of privilege vulnerability in the Qualcomm video driver, which could allow a local malicious application to execute arbitrary code within the context of the kernel. This is rated as High because it first requires compromising a privileged process. The vulnerability is also associated with insufficient access control in the Qualcomm video driver, potentially allowing a remote attacker to execute arbitrary code.

The issue is related to a video kernel driver component by Qualcomm in the Android operating system, which has insufficient access control. This can be exploited by a local attacker using a specially crafted application to elevate their privileges.

The issue is related to a Qualcomm Power Management kernel driver in Android, which allows attackers to gain privileges via a crafted application that leverages root access. This is due to insufficient input validation, which can be exploited by a remote attacker to elevate their privileges using a specially crafted application that utilizes root access.

The issue is related to the performance event manager for Qualcomm ARM processors in Android, which has inadequate access control to certain functions. This allows attackers to gain privileges via a crafted application. The estimated number of potentially affected devices is not specified.