Description

Memory corruption while IOCLT is called when device is in invalid state and the WMI command buffer may be freed twice.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon	FastConnect 6700; FastConnect 6900; FastConnect 7800; QCC2073; QCC2076; QCM5430; QCM6490; QCS5430; QCS6490; Qualcomm Video Collaboration VC3 Platform; SC8380XP; SDM429W; Snapdragon 429 Mobile Platform; Snapdragon 8cx Gen 3 Compute Platform (SC8280XP-AB, BB); WCD9370; WCD9375; WCD9380; WCD9385; WCN3620; WCN3660B
qualcomm	fastconnect_6700_firmware	<= *
qualcomm	fastconnect_6900_firmware	<= *
qualcomm	fastconnect_7800_firmware	<= *
qualcomm	qcc2073_firmware	<= *
qualcomm	qcc2076_firmware	<= *
qualcomm	qcm5430_firmware	<= *
qualcomm	qcm6490_firmware	<= *
qualcomm	qcs5430_firmware	<= *
qualcomm	qcs6490_firmware	<= *
qualcomm	qualcomm_video_collaboration_vc3_platform_firmware	<= *
qualcomm	sc8380xp_firmware	<= *
qualcomm	sdm429w_firmware	<= *
qualcomm	snapdragon_429_mobile_platform_firmware	<= *
qualcomm	wcd9370_firmware	<= *
qualcomm	wcd9375_firmware	<= *
qualcomm	wcd9380_firmware	<= *
qualcomm	wcd9385_firmware	<= *
qualcomm	wcn3620_firmware	<= *
qualcomm	wcn3660b_firmware	<= *
qualcomm	wsa8830_firmware	<= *
qualcomm	wsa8835_firmware	<= *
qualcomm	wsa8840_firmware	<= *
qualcomm	wsa8845_firmware	<= *
qualcomm	wsa8845h_firmware	<= *