CVSS: 7.8EPSS: 0%CPEs: 66EXPL: 0CVE-2022-33226 – Buffer copy without checking the size of input in Core
https://notcve.org/view.php?id=CVE-2022-33226
Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications. • https://www.qualcomm.com/company/product-security/bulletins/june-2023-bulletin • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.8EPSS: 0%CPEs: 92EXPL: 0CVE-2022-33224 – Buffer copy without checking the size of input in Core
https://notcve.org/view.php?id=CVE-2022-33224
Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries. • https://www.qualcomm.com/company/product-security/bulletins/june-2023-bulletin • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 7.1EPSS: 0%CPEs: 696EXPL: 0CVE-2022-22076 – Cryptographic issue in Core
https://notcve.org/view.php?id=CVE-2022-22076
information disclosure due to cryptographic issue in Core during RPMB read request. • https://www.qualcomm.com/company/product-security/bulletins/june-2023-bulletin • CWE-310: Cryptographic Issues •
CVSS: 7.5EPSS: 0%CPEs: 384EXPL: 0CVE-2022-40504 – Reachable assertion in Modem
https://notcve.org/view.php?id=CVE-2022-40504
Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network. • https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin • CWE-617: Reachable Assertion •
CVSS: 8.4EPSS: 0%CPEs: 334EXPL: 0CVE-2023-21666 – Improper Release of Memory Before Removing Last Reference (`Memory Leak`) in Graphics
https://notcve.org/view.php?id=CVE-2023-21666
Memory Corruption in Graphics while accessing a buffer allocated through the graphics pool. On Qualcomm Adreno/KGSL builds where CONFIG_QCOM_KGSL_USE_SHMEM is not set (or on older KGSL versions without CONFIG_QCOM_KGSL_USE_SHMEM), KGSL allocates GPU-shared memory from its own page pool. Pages from this pool are inserted into VMAs that don't have any weird flags like VM_PFNMAP set, which means userspace can grab extra references to these pages through get_user_pages() (for example, using vmsplice()). But when GPU-shared memory is freed, KGSL puts the freed pages into its own page pool without checking the page refcount. This means that pages that are still accessible from userspace can be reallocated as GPU memory by another process. • http://packetstormsecurity.com/files/172664/Qualcomm-Adreno-KGSL-Data-Leakage.html https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin • CWE-401: Missing Release of Memory after Effective Lifetime •