Qca6436 Firmware vulnerabilities

60 known vulnerabilities in Qca6436 Firmware from Qualcomm. 60 are rated high or critical, and 4 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  Snapdragon: Use After Free

  CVE-2024-33040Dec 2, 2024Qualcomm

  Memory corruption while invoking redundant release command to release one buffer from user space as race condition can occur in kernel space between buffer release and buffer access.

• 7.8 High severity

  Qualcomm Multiple Chipsets Use-After-Free Exploited

  CVE-2024-43047Oct 7, 2024Qualcomm

  Memory corruption while maintaining memory maps of HLOS memory.

• 7.5 High severity

  Snapdragon: Buffer Over-read

  CVE-2024-23364Sep 2, 2024Qualcomm

  Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).

• 7.5 High severity

  Snapdragon: Improper Authentication

  CVE-2023-43551Jun 3, 2024Qualcomm

  Cryptographic issue while performing attach with a LTE network, a rogue base station can skip the authentication phase and immediately send the Security Mode Command.

• 7.8 High severity

  Snapdragon: Out-of-bounds Write

  CVE-2023-43513Feb 6, 2024Qualcomm

  Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element.

• 7.8 High severity

  Qualcomm Multiple Chipsets Integer Overflow Exploited

  CVE-2023-33107Dec 5, 2023QualcommEPSS 1.02%

  Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

• 7.8 High severity

  Qualcomm Multiple Chipsets Use of Out-of-Range Pointer Offset Exploited

  CVE-2023-33106Dec 5, 2023Qualcomm

  Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.

• 7.8 High severity

  Snapdragon: Use After Free

  CVE-2023-28577Aug 8, 2023Qualcomm

  In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which cause

• 7.0 High severity

  Snapdragon: Time-of-check Time-of-use (TOCTOU) Race Condition

  CVE-2023-28576Aug 8, 2023Qualcomm

  The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel

• 7.8 High severity

  Snapdragon: Access of Resource Using Incompatible Type

  CVE-2023-28575Aug 8, 2023Qualcomm

  The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.

• 8.1 High severity

  Snapdragon Auto, Snapdragon Compute…: Out-of-bounds Read

  CVE-2022-33268Dec 13, 2022Qualcomm

  Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Buffer Copy without Checking Size of Input

  CVE-2022-25712Dec 13, 2022Qualcomm

  Memory corruption in camera due to buffer copy without checking size of input in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Wearables

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Improper Validation of Array Index

  CVE-2022-25711Dec 13, 2022Qualcomm

  Memory corruption in camera due to improper validation of array index in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

• 7.5 High severity

  Snapdragon Auto, Snapdragon Compute…: Reachable Assertion

  CVE-2022-25702Dec 13, 2022Qualcomm

  Denial of service in modem due to reachable assertion while processing reconfiguration message in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Improper Validation of Array Index

  CVE-2022-25695Dec 13, 2022Qualcomm

  Memory corruption in MODEM due to Improper Validation of Array Index while processing GSTK Proactive commands in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile

• 7.5 High severity

  Snapdragon Auto, Snapdragon Compute…: Improper Authentication

  CVE-2022-25685Dec 13, 2022Qualcomm

  Denial of service in Modem module due to improper authorization while error handling in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2022-25681Dec 13, 2022Qualcomm

  Possible memory corruption in kernel while performing memory access due to hypervisor not correctly invalidated the processor translation caches in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Use After Free

  CVE-2022-25677Dec 13, 2022Qualcomm

  Memory corruption in diag due to use after free while processing dci packet in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking

• 7.5 High severity

  Snapdragon Compute, Snapdragon Connectivity…: Out-of-bounds Read

  CVE-2022-33236Nov 15, 2022Qualcomm

  Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking

• 9.8 Critical severity

  Snapdragon Auto, Snapdragon Compute…: Out-of-bounds Write

  CVE-2022-33234Nov 15, 2022Qualcomm

  Memory corruption in video due to configuration weakness. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Use After Free

  CVE-2022-25743Nov 15, 2022Qualcomm

  Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wea

• 7.5 High severity

  Snapdragon Auto, Snapdragon Compute…: NULL Pointer Dereference

  CVE-2022-25741Nov 15, 2022Qualcomm

  Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Buffer Copy without Checking Size of Input

  CVE-2022-25724Nov 15, 2022Qualcomm

  Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon

• 9.8 Critical severity

  Snapdragon Auto, Snapdragon Compute…: Buffer Copy without Checking Size of Input

  CVE-2022-25687Oct 19, 2022Qualcomm

  memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

• 7.5 High severity

  Snapdragon Auto, Snapdragon Compute…: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2022-25662Oct 19, 2022Qualcomm

  Information disclosure due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Improper Restriction of Operations within the Bounds of a Memory Buffer

  CVE-2022-25661Oct 19, 2022Qualcomm

  Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Double Free

  CVE-2022-25660Oct 19, 2022Qualcomm

  Memory corruption due to double free issue in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile

• 7.5 High severity

  Snapdragon Auto, Snapdragon Compute…: Out-of-bounds Read

  CVE-2022-25706Sep 16, 2022Qualcomm

  Information disclosure in Bluetooth driver due to buffer over-read while reading l2cap length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

• 7.5 High severity

  Snapdragon Auto, Snapdragon Compute…: Improper Validation of Array Index

  CVE-2022-25690Sep 16, 2022Qualcomm

  Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon

• 9.8 Critical severity

  Snapdragon Auto, Snapdragon Compute…: Buffer Copy without Checking Size of Input

  CVE-2022-25688Sep 16, 2022Qualcomm

  Memory corruption in video due to buffer overflow while parsing ps video clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearable

• 9.8 Critical severity

  Snapdragon Auto, Snapdragon Compute…: Buffer Copy without Checking Size of Input

  CVE-2022-25686Sep 16, 2022Qualcomm

  Memory corruption in video module due to buffer overflow while processing WAV file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables

• 7.5 High severity

  Snapdragon Auto, Snapdragon Compute…: Out-of-bounds Read

  CVE-2022-25670Sep 16, 2022Qualcomm

  Denial of service in WLAN HOST due to buffer over read while unpacking frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,

• 7.5 High severity

  Snapdragon Auto, Snapdragon Compute…: Out-of-bounds Read

  CVE-2022-25669Sep 16, 2022Qualcomm

  Denial of service in video due to buffer over read while parsing MP4 clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Integer Overflow or Wraparound

  CVE-2022-25656Sep 16, 2022Qualcomm

  Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Sn

• 7.8 High severity

  Snapdragon Compute, Snapdragon Connectivity…: Use After Free

  CVE-2022-22095Sep 16, 2022Qualcomm

  Memory corruption in synx driver due to use-after-free condition in the synx driver due to accessing object handles without acquiring lock in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

• 7.0 High severity

  Snapdragon Compute, Snapdragon Connectivity…: Time-of-check Time-of-use (TOCTOU) Race Condition

  CVE-2022-22094Sep 16, 2022Qualcomm

  memory corruption in Kernel due to race condition while getting mapping reference in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

• 7.0 High severity

  Snapdragon Compute, Snapdragon Connectivity…: Time-of-check Time-of-use (TOCTOU) Race Condition

  CVE-2022-22093Sep 16, 2022Qualcomm

  Memory corruption or temporary denial of service due to improper handling of concurrent hypervisor operations to attach or detach IRQs from virtual interrupt sources in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Integer Overflow or Wraparound

  CVE-2022-22074Sep 16, 2022Qualcomm

  Memory Corruption during wma file playback due to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables

• 7.8 High severity

  Snapdragon Auto, Snapdragon Compute…: Out-of-bounds Read

  CVE-2022-22066Sep 16, 2022Qualcomm

  Memory corruption occurs while processing command received from HLOS due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,

• 9.8 Critical severity

  Snapdragon Auto, Snapdragon Compute…: Double Free

  CVE-2022-25668Sep 2, 2022Qualcomm

  Memory corruption in video driver due to double free while parsing ASF clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables