Huawei Harmonyos vulnerabilities

CVE-2023-26547 [HIGH] CWE-502 CVE-2023-26547: The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exp The InputMethod module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.

CVE-2021-22416 [HIGH] CVE-2021-22416: A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel Code Execution.

CVE-2021-22420 [HIGH] CWE-668 CVE-2021-22420: A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause the underlying trust of the application trustlist mechanism is missing..

CVE-2021-40027 [HIGH] CWE-476 CVE-2021-40027: The bone voice ID TA has a vulnerability in calculating the buffer length,Successful exploitation of The bone voice ID TA has a vulnerability in calculating the buffer length,Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2022-34742 [HIGH] CWE-125 CVE-2022-34742: The system module has a read/write vulnerability. Successful exploitation of this vulnerability may The system module has a read/write vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-40065 [HIGH] CVE-2021-40065: The communication module has a service logic error vulnerability.Successful exploitation of this vul The communication module has a service logic error vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-37037 [HIGH] CVE-2021-37037: There is an Invalid address access vulnerability in Huawei Smartphone.Successful exploitation of thi There is an Invalid address access vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the device to restart.

CVE-2021-39970 [HIGH] CWE-22 CVE-2021-39970: HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerab HwPCAssistant has a Improper Input Validation vulnerability.Successful exploitation of this vulnerability may create any file with the system app permission.

CVE-2021-37009 [HIGH] CVE-2021-37009: There is a Configuration vulnerability in Huawei Smartphone.Successful exploitation of this vulnerab There is a Configuration vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause the confidentiality of users is affected.

CVE-2021-40022 [HIGH] CVE-2021-40022: The weaver module has a vulnerability in parameter type verification,Successful exploitation of this The weaver module has a vulnerability in parameter type verification,Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-37075 [HIGH] CVE-2021-37075: There is a Credentials Management Errors vulnerability in Huawei Smartphone.Successful exploitation There is a Credentials Management Errors vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to confidentiality affected.

CVE-2021-40021 [HIGH] CWE-787 CVE-2021-40021: The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulne The eID module has an out-of-bounds memory write vulnerability,Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-40025 [HIGH] CWE-665 CVE-2021-40025: The eID module has a vulnerability that causes the memory to be used without being initialized,Succe The eID module has a vulnerability that causes the memory to be used without being initialized,Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-40018 [HIGH] CWE-476 CVE-2021-40018: The eID module has a null pointer reference vulnerability. Successful exploitation of this vulnerabi The eID module has a null pointer reference vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-39972 [HIGH] CWE-200 CVE-2021-39972: MyHuawei-App has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successf MyHuawei-App has a Exposure of Sensitive Information to an Unauthorized Actor vulnerability.Successful exploitation of this vulnerability could compromise confidentiality.

CVE-2021-37060 [HIGH] CWE-20 CVE-2021-37060: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of t There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to SAMGR Heap Address Leakage.

CVE-2021-37096 [HIGH] CWE-20 CVE-2021-37096: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of t There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to user privacy disclosed.

CVE-2021-40004 [HIGH] CWE-276 CVE-2021-40004: The cellular module has a vulnerability in permission management. Successful exploitation of this vu The cellular module has a vulnerability in permission management. Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2022-29792 [HIGH] CVE-2022-29792: The chip component has a vulnerability of disclosing CPU SNs.Successful exploitation of this vulnera The chip component has a vulnerability of disclosing CPU SNs.Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2021-40061 [HIGH] CWE-843 CVE-2021-40061: There is a vulnerability of accessing resources using an incompatible type (type confusion) in the B There is a vulnerability of accessing resources using an incompatible type (type confusion) in the Bastet module. Successful exploitation of this vulnerability may affect integrity.