CVSS: 8.4EPSS: 0%CPEs: 484EXPL: 0CVE-2022-40507 – Double free in Core
https://notcve.org/view.php?id=CVE-2022-40507
Memory corruption due to double free in Core while mapping HLOS address to the list. • https://www.qualcomm.com/company/product-security/bulletins/june-2023-bulletin • CWE-415: Double Free •
CVSS: 7.9EPSS: 0%CPEs: 484EXPL: 0CVE-2022-33264 – Stack-based buffer overflow in Modem
https://notcve.org/view.php?id=CVE-2022-33264
Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message. • https://www.qualcomm.com/company/product-security/bulletins/june-2023-bulletin • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.1EPSS: 0%CPEs: 696EXPL: 0CVE-2022-22076 – Cryptographic issue in Core
https://notcve.org/view.php?id=CVE-2022-22076
information disclosure due to cryptographic issue in Core during RPMB read request. • https://www.qualcomm.com/company/product-security/bulletins/june-2023-bulletin • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 0%CPEs: 384EXPL: 0CVE-2022-40504 – Reachable assertion in Modem
https://notcve.org/view.php?id=CVE-2022-40504
Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network. • https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin • CWE-617: Reachable Assertion •
CVSS: 8.4EPSS: 0%CPEs: 334EXPL: 0CVE-2023-21666 – Improper Release of Memory Before Removing Last Reference (`Memory Leak`) in Graphics
https://notcve.org/view.php?id=CVE-2023-21666
Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool. On Qualcomm Adreno/KGSL builds where CONFIG_QCOM_KGSL_USE_SHMEM is not set (or on older KGSL versions without CONFIG_QCOM_KGSL_USE_SHMEM), KGSL allocates GPU-shared memory from its own page pool. Pages from this pool are inserted into VMAs that don't have any weird flags like VM_PFNMAP set, which means userspace can grab extra references to these pages through get_user_pages() (for example, using vmsplice()). But when GPU-shared memory is freed, KGSL puts the freed pages into its own page pool without checking the page refcount. This means that pages that are still accessible from userspace can be reallocated as GPU memory by another process. • http://packetstormsecurity.com/files/172664/Qualcomm-Adreno-KGSL-Data-Leakage.html https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin • CWE-401: Missing Release of Memory after Effective Lifetime •