Huawei Harmonyos vulnerabilities

CVE-2021-37022 [CRITICAL] CWE-787 CVE-2021-37022: There is a Heap-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of There is a Heap-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability will cause root permission which can be escalated.

CVE-2021-22432 [CRITICAL] CWE-119 CVE-2021-22432: There is a vulnerability when configuring permission isolation in smartphones. Successful exploitati There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access.

CVE-2021-22430 [CRITICAL] CVE-2021-22430: There is a logic bypass vulnerability in smartphones. Successful exploitation of this vulnerability There is a logic bypass vulnerability in smartphones. Successful exploitation of this vulnerability may cause code injection.

CVE-2021-22431 [CRITICAL] CWE-119 CVE-2021-22431: There is a vulnerability when configuring permission isolation in smartphones. Successful exploitati There is a vulnerability when configuring permission isolation in smartphones. Successful exploitation of this vulnerability may cause out-of-bounds access.

CVE-2021-39990 [CRITICAL] CWE-787 CVE-2021-39990: The screen lock module has a Stack-based Buffer Overflow vulnerability.Successful exploitation of th The screen lock module has a Stack-based Buffer Overflow vulnerability.Successful exploitation of this vulnerability may affect user experience.

CVE-2022-44558 [CRITICAL] CWE-502 CVE-2022-44558: The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitatio The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.

CVE-2022-44562 [CRITICAL] CWE-502 CVE-2022-44562: The system framework layer has a vulnerability of serialization/deserialization mismatch. Successful The system framework layer has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.

CVE-2022-44559 [CRITICAL] CWE-502 CVE-2022-44559: The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitatio The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.

CVE-2022-46316 [CRITICAL] CWE-287 CVE-2022-46316: A thread security vulnerability exists in the authentication process. Successful exploitation of thi A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integrity, confidentiality, and availability.

CVE-2023-46773 [CRITICAL] CWE-276 CVE-2023-46773: Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability Permission management vulnerability in the PMS module. Successful exploitation of this vulnerability may cause privilege escalation.

CVE-2023-52378 [CRITICAL] CWE-693 CVE-2023-52378: Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation Vulnerability of incorrect service logic in the WindowManagerServices module.Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2023-52370 [CRITICAL] CWE-120 CVE-2023-52370: Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vuln Stack overflow vulnerability in the network acceleration module.Successful exploitation of this vulnerability may cause unauthorized file access.

CVE-2021-39982 [CRITICAL] CWE-269 CVE-2021-39982: Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation Phone Manager application has a Improper Privilege Management vulnerability.Successful exploitation of this vulnerability may read and write arbitrary files by tampering with Phone Manager notifications.

CVE-2022-38986 [CRITICAL] CWE-787 CVE-2022-38986: The HIPP module has a vulnerability of bypassing the check of the data transferred in the kernel spa The HIPP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause out-of-bounds access to the HIPP module and page table tampering, affecting device confidentiality and availability.

CVE-2024-45443 [CRITICAL] CWE-22 CVE-2024-45443: Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnera Directory traversal vulnerability in the cust module Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

CVE-2023-39407 [CRITICAL] CWE-22 CVE-2023-39407: The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability ma The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity.

CVE-2023-39385 [CRITICAL] CWE-16 CVE-2023-39385: Vulnerability of configuration defects in the media module of certain products.. Successful exploita Vulnerability of configuration defects in the media module of certain products.. Successful exploitation of this vulnerability may cause unauthorized access.

CVE-2022-41580 [CRITICAL] CWE-125 CVE-2022-41580: The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation o The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.

CVE-2024-32991 [CRITICAL] CWE-16 CVE-2024-32991: Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation o Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2023-39405 [CRITICAL] CWE-20 CVE-2023-39405: Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of this vulnerability may cause other apps to be executed with escalated privileges.