Jianqiang Zhao

Existe um problema de estouro de buffer no aplicativo de vídeo do Qualcomm Snapdragon devido ao tamanho do buffer de destino ser menor que o tamanho do buffer de origem. Esse problema afeta vários produtos Snapdragon, incluindo Compute, Consumer IoT, Industrial IoT, Mobile, Voice & Music e Wearables, em vários chipsets, como Bitra, MSM8909W, QCM2150, QCS405, QCS605, Saipan, SC8180X, SDA845, SDM429W, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250 e SXR2130.

**Nome do software vulnerável e versões afetadas: Versões do Qualcomm Snapdragon (versões afetadas não especificadas) Descrição: O problema está relacionado ao fato de a gravação em registros via debugfs estar desativada por padrão, a fim de impedir gravações não autorizadas. Isso afeta vários produtos Qualcomm Snapdragon, incluindo Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IoT, Snapdragon Industrial IoT, Snapdragon Mobile e Snapdragon Voice & Music, em chipsets específicos como MDM9206, MDM9207C, MDM9607, Nicobar, QCS405, SA6155P, SC8180X, SDX55 e SM8150. Recomendações: No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

A kernel overwrite can potentially occur in a camera driver ioctl in Qualcomm products with Android releases from CAF using the Linux kernel.

The issue is related to a missing bounds check in a camera driver function in Android, potentially leading to an out-of-bounds heap write. This could allow a remote attacker to access memory outside the application's boundaries.

The issue is related to the camera application, which can request frame/command buffer processing with invalid values. This leads to a heap buffer over-read by the driver. The exploitation of this issue may allow a remote attacker to cause a re-read of the dynamic memory buffer.

The issue is related to an elevation of privilege vulnerability in the Qualcomm camera driver, which could allow a local malicious application to execute arbitrary code within the context of the kernel. This problem is rated as High because it first requires compromising a privileged process.

An information disclosure issue in the Qualcomm video driver could allow a local malicious application to access data outside of its permission levels. This issue requires compromising a privileged process.

An information disclosure issue in the Qualcomm video driver could allow a local malicious application to access data outside of its permission levels. This issue requires compromising a privileged process and is rated as Moderate.

A remote code execution issue in the Framesequence library could allow an attacker to execute arbitrary code in the context of an unprivileged process using a specially crafted file. This issue is considered High due to the possibility of remote code execution in an application that uses the Framesequence library.

An information disclosure issue in Qualcomm components, including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver, could allow a local malicious application to access data outside of its permission levels. This issue requires compromising a privileged process.

An elevation of privilege issue in the Qualcomm bus driver could allow a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.

The issue involves an information disclosure vulnerability in Qualcomm components in Android and a buffer overflow vulnerability in Adobe Acrobat Document Cloud. The Android vulnerability could allow a local malicious application to access data outside of its permission levels, but it first requires compromising a privileged process. The Adobe Acrobat Document Cloud vulnerability is caused by a buffer overflow in memory and could allow a remote attacker to execute arbitrary code or cause a denial of service (memory corruption).

The issue allows attackers to obtain sensitive information via a crafted application.

The issue is related to the Qualcomm QDSP6v2 driver in Android, where certain data structures are not properly initialized in the audio utils.c file. This allows attackers to obtain sensitive information by using a crafted application.

The issue is related to the Qualcomm QDSP6v2 driver in Android, where certain data structures are not properly initialized in the audio utils.c file. This allows attackers to obtain sensitive information by using a crafted application.

A buffer overflow issue exists in the Qualcomm subsystem driver, specifically in the drivers/soc/qcom/subsystem restart.c file. This issue can be exploited by attackers to gain privileges via a crafted application that provides a long string.

The issue is related to the NVIDIA camera driver in Android, which lacks protection of internal data. This allows attackers to obtain sensitive information via a crafted application.

The issue is related to insufficient access control in the NVIDIA camera driver for the Android operating system. It allows a remote attacker to elevate their privileges using a specially crafted application.

The issue is related to insufficient access control in the Qualcomm buspm driver of the Android operating system. It allows a remote attacker to elevate their privileges using a specially crafted application.

The issue is related to the NVIDIA media driver in Android, which has inadequate access control. This allows an attacker to gain privileges via a crafted application. The estimated number of potentially affected devices worldwide is not specified.