title: Use of Out-of-range Pointer Offset in Audio
description: The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory corruption.
affected:
{
defaultStatus: unaffected
platforms: [Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables]
product: Snapdragon
vendor: Qualcomm, Inc.
versions:
status: affected, version: 315 5G IoT Modem
status: affected, version: 9206 LTE Modem
status: affected, version: APQ8017
status: affected, version: APQ8064AU
status: affected, version: AQT1000
status: affected, version: AR8031
status: affected, version: AR8035
status: affected, version: C-V2X 9150
status: affected, version: CSRA6620
status: affected, version: CSRA6640
status: affected, version: CSRB31024
status: affected, version: FastConnect 6200
status: affected, version: FastConnect 6700
status: affected, version: FastConnect 6800
status: affected, version: FastConnect 6900
status: affected, version: FastConnect 7800
status: affected, version: Flight RB5 5G Platform
status: affected, version: MDM9230
status: affected, version: MDM9250
status: affected, version: MDM9330
status: affected, version: MDM9628
status: affected, version: MDM9630
status: affected, version: MDM9640
status: affected, version: MDM9650
status: affected, version: MSM8108
status: affected, version: MSM8209
status: affected, version: MSM8608
status: affected, version: MSM8909W
status: affected, version: MSM8996AU
status: affected, version: QAM8255P
status: affected, version: QAM8295P
status: affected, version: QAM8650P
status: affected, version: QAM8775P
status: affected, version: QCA6174
status: affected, version: QCA6174A
status: affected, version: QCA6310
status: affected, version: QCA6320
status: affected, version: QCA6335
status: affected, version: QCA6391
status: affected, version: QCA6420
status: affected, version: QCA6421
status: affected, version: QCA6426
status: affected, version: QCA6430
status: affected, version: QCA6431
status: affected, version: QCA6436
status: affected, version: QCA6564
status: affected, version: QCA6564A
status: affected, version: QCA6564AU
status: affected, version: QCA6574
status: affected, version: QCA6574A
status: affected, version: QCA6574AU
status: affected, version: QCA6584
status: affected, version: QCA6584AU
status: affected, version: QCA6595
status: affected, version: QCA6595AU
status: affected, version: QCA6696
status: affected, version: QCA6698AQ
status: affected, version: QCA6797AQ
status: affected, version: QCA8081
status: affected, version: QCA8337
status: affected, version: QCA9367
status: affected, version: QCA9377
status: affected, version: QCC710
status: affected, version: QCM2290
status: affected, version: QCM4290
status: affected, version: QCM4325
status: affected, version: QCM6125
status: affected, version: QCM6490
status: affected, version: QCM8550
status: affected, version: QCN6224
status: affected, version: QCN6274
status: affected, version: QCN9011
status: affected, version: QCN9012
status: affected, version: QCN9074
status: affected, version: QCS2290
status: affected, version: QCS410
status: affected, version: QCS4290
status: affected, version: QCS610
status: affected, version: QCS6125
status: affected, version: QCS6490
status: affected, version: QCS7230
status: affected, version: QCS8250
status: affected, version: QCS8550
status: affected, version: QFW7114
status: affected, version: QFW7124
status: affected, version: QRB5165M
status: affected, version: QRB5165N
status: affected, version: Qualcomm 205 Mobile Platform
status: affected, version: Qualcomm 215 Mobile Platform
status: affected, version: Qualcomm Video Collaboration VC1 Platform
status: affected, version: Qualcomm Video Collaboration VC3 Platform
status: affected, version: Qualcomm Video Collaboration VC5 Platform
status: affected, version: Robotics RB3 Platform
status: affected, version: Robotics RB5 Platform
status: affected, version: SA4150P
status: affected, version: SA4155P
status: affected, version: SA6145P
status: affected, version: SA6150P
status: affected, version: SA6155
status: affected, version: SA6155P
status: affected, version: SA8145P
status: affected, version: SA8150P
status: affected, version: SA8155
status: affected, version: SA8155P
status: affected, version: SA8195P
status: affected, version: SA8255P
status: affected, version: SA8295P
status: affected, version: SD 675
status: affected, version: SD626
status: affected, version: SD660
status: affected, version: SD670
status: affected, version: SD675
status: affected, version: SD730
status: affected, version: SD835
status: affected, version: SD855
status: affected, version: SD865 5G
status: affected, version: SD888
status: affected, version: SDM429W
status: affected, version: SDX20M
status: affected, version: SDX55
status: affected, version: SG4150P
status: affected, version: SG8275P
status: affected, version: SM4125
status: affected, version: SM6250
status: affected, version: SM7250P
status: affected, version: SM7315
status: affected, version: SM7325P
status: affected, version: SM8550P
status: affected, version: Smart Audio 200 Platform
status: affected, version: Smart Audio 400 Platform
status: affected, version: Smart Display 200 Platform (APQ5053-AA)
status: affected, version: Snapdragon 1200 Wearable Platform
status: affected, version: Snapdragon 208 Processor
status: affected, version: Snapdragon 210 Processor
status: affected, version: Snapdragon 212 Mobile Platform
status: affected, version: Snapdragon 4 Gen 1 Mobile Platform
status: affected, version: Snapdragon 429 Mobile Platform
status: affected, version: Snapdragon 460 Mobile Platform
status: affected, version: Snapdragon 480 5G Mobile Platform
status: affected, version: Snapdragon 480+ 5G Mobile Platform (SM4350-AC)
status: affected, version: Snapdragon 660 Mobile Platform
status: affected, version: Snapdragon 662 Mobile Platform
status: affected, version: Snapdragon 665 Mobile Platform
status: affected, version: Snapdragon 670 Mobile Platform
status: affected, version: Snapdragon 675 Mobile Platform
status: affected, version: Snapdragon 678 Mobile Platform (SM6150-AC)
status: affected, version: Snapdragon 680 4G Mobile Platform
status: affected, version: Snapdragon 685 4G Mobile Platform (SM6225-AD)
status: affected, version: Snapdragon 690 5G Mobile Platform
status: affected, version: Snapdragon 695 5G Mobile Platform
status: affected, version: Snapdragon 710 Mobile Platform
status: affected, version: Snapdragon 720G Mobile Platform
status: affected, version: Snapdragon 730 Mobile Platform (SM7150-AA)
status: affected, version: Snapdragon 730G Mobile Platform (SM7150-AB)
status: affected, version: Snapdragon 732G Mobile Platform (SM7150-AC)
status: affected, version: Snapdragon 750G 5G Mobile Platform
status: affected, version: Snapdragon 765 5G Mobile Platform (SM7250-AA)
status: affected, version: Snapdragon 765G 5G Mobile Platform (SM7250-AB)
status: affected, version: Snapdragon 768G 5G Mobile Platform (SM7250-AC)
status: affected, version: Snapdragon 778G 5G Mobile Platform
status: affected, version: Snapdragon 778G+ 5G Mobile Platform (SM7325-AE)
status: affected, version: Snapdragon 780G 5G Mobile Platform
status: affected, version: Snapdragon 782G Mobile Platform (SM7325-AF)
status: affected, version: Snapdragon 7c+ Gen 3 Compute
status: affected, version: Snapdragon 8 Gen 2 Mobile Platform
status: affected, version: Snapdragon 8+ Gen 2 Mobile Platform
status: affected, version: Snapdragon 820 Automotive Platform
status: affected, version: Snapdragon 835 Mobile PC Platform
status: affected, version: Snapdragon 845 Mobile Platform
status: affected, version: Snapdragon 855 Mobile Platform
status: affected, version: Snapdragon 855+/860 Mobile Platform (SM8150-AC)
status: affected, version: Snapdragon 865 5G Mobile Platform
status: affected, version: Snapdragon 865+ 5G Mobile Platform (SM8250-AB)
status: affected, version: Snapdragon 870 5G Mobile Platform (SM8250-AC)
status: affected, version: Snapdragon 888 5G Mobile Platform
status: affected, version: Snapdragon 888+ 5G Mobile Platform (SM8350-AC)
status: affected, version: Snapdragon Auto 5G Modem-RF
status: affected, version: Snapdragon W5+ Gen 1 Wearable Platform
status: affected, version: Snapdragon Wear 2100 Platform
status: affected, version: Snapdragon Wear 2500 Platform
status: affected, version: Snapdragon Wear 3100 Platform
status: affected, version: Snapdragon Wear 4100+ Platform
status: affected, version: Snapdragon X12 LTE Modem
status: affected, version: Snapdragon X20 LTE Modem
status: affected, version: Snapdragon X24 LTE Modem
status: affected, version: Snapdragon X5 LTE Modem
status: affected, version: Snapdragon X50 5G Modem-RF System
status: affected, version: Snapdragon X55 5G Modem-RF System
status: affected, version: Snapdragon X75 5G Modem-RF System
status: affected, version: Snapdragon XR1 Platform
status: affected, version: Snapdragon XR2 5G Platform
status: affected, version: Snapdragon XR2+ Gen 1 Platform
status: affected, version: Snapdragon Auto 4G Modem
status: affected, version: SW5100
status: affected, version: SW5100P
status: affected, version: SXR1120
status: affected, version: SXR2130
status: affected, version: Vision Intelligence 100 Platform (APQ8053-AA)
status: affected, version: Vision Intelligence 200 Platform (APQ8053-AC)
status: affected, version: Vision Intelligence 400 Platform
status: affected, version: WCD9326
status: affected, version: WCD9330
status: affected, version: WCD9335
status: affected, version: WCD9340
status: affected, version: WCD9341
status: affected, version: WCD9360
status: affected, version: WCD9370
status: affected, version: WCD9371
status: affected, version: WCD9375
status: affected, version: WCD9380
status: affected, version: WCD9385
status: affected, version: WCD9390
status: affected, version: WCD9395
status: affected, version: WCN3610
status: affected, version: WCN3615
status: affected, version: WCN3620
status: affected, version: WCN3660B
status: affected, version: WCN3680
status: affected, version: WCN3680B
status: affected, version: WCN3910
status: affected, version: WCN3950
status: affected, version: WCN3980
status: affected, version: WCN3988
status: affected, version: WCN3990
status: affected, version: WCN6740
status: affected, version: WSA8810
status: affected, version: WSA8815
status: affected, version: WSA8830
status: affected, version: WSA8835
status: affected, version: WSA8840
status: affected, version: WSA8845
status: affected, version: WSA8845H
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL