Memory corruption while processing IOCTL calls for escape operations.
Memory corruption while processing multiple IOCTL command for escape operations.
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.
Memory corruption while accessing a buffer during IOCTL processing.
Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently.
Memory corruption while IOCTL call is invoked from user-space to read board data.
Memory corruption while processing IOCTL calls.
Memory corruption while processing an IOCTL command with an arbitrary address.
Memory corruption while handling different IOCTL calls from the user-space simultaneously.
Memory corruption while processing IOCTL calls to unmap the buffers.
Memory corruption can occur when a compat IOCTL call is followed by a normal IOCTL call from userspace.
Memory Corruption when accessing a buffer after it has been freed while processing IOCTL calls.
Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit.
Memory Corruption while invoking IOCTL calls when concurrent access to shared buffer occurs.
Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously.
memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.
Memory corruption while processing IOCTL command when device is in power-save state.
Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.
Page 1+ Next →