Huawei Harmonyos vulnerabilities

CVE-2023-39405 [CRITICAL] CWE-20 CVE-2023-39405: Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of this vulnerability may cause other apps to be executed with escalated privileges.

CVE-2023-44106 [CRITICAL] CWE-269 CVE-2023-44106: API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vu API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2023-41294 [CRITICAL] CWE-400 CVE-2023-41294: The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability ma The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services.

CVE-2023-44116 [CRITICAL] CWE-306 CVE-2023-44116: Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful e Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may cause some apps to run without being authorized.

CVE-2024-57961 [CRITICAL] CWE-787 CVE-2024-57961: Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulner Out-of-bounds write vulnerability in the emcom module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2023-37245 [CRITICAL] CWE-120 CVE-2023-37245: Buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerabi Buffer overflow vulnerability in the modem pinctrl module. Successful exploitation of this vulnerability may affect the integrity and availability of the modem.

CVE-2023-52369 [CRITICAL] CWE-787 CVE-2023-52369: Stack overflow vulnerability in the NFC module.Successful exploitation of this vulnerability may aff Stack overflow vulnerability in the NFC module.Successful exploitation of this vulnerability may affect service availability and integrity.

CVE-2024-30415 [CRITICAL] CWE-276 CVE-2024-30415: Vulnerability of improper permission control in the window management module. Impact: Successful exp Vulnerability of improper permission control in the window management module. Impact: Successful exploitation of this vulnerability will affect availability.

CVE-2021-40010 [CRITICAL] CWE-787 CVE-2021-40010: The bone voice ID TA has a heap overflow vulnerability.Successful exploitation of this vulnerability The bone voice ID TA has a heap overflow vulnerability.Successful exploitation of this vulnerability may result in malicious code execution.

CVE-2021-37045 [CRITICAL] CWE-416 CVE-2021-37045: There is an UAF vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may There is an UAF vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may cause the device to restart unexpectedly and the kernel-mode code to be executed.

CVE-2022-39007 [CRITICAL] CWE-269 CVE-2022-39007: The location module has a vulnerability of bypassing permission verification.Successful exploitation The location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privilege escalation.

CVE-2022-41580 [CRITICAL] CWE-125 CVE-2022-41580: The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation o The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.

CVE-2022-48512 [CRITICAL] CWE-122 CVE-2022-48512: Use After Free (UAF) vulnerability in the Vdecoderservice service. Successful exploitation of this v Use After Free (UAF) vulnerability in the Vdecoderservice service. Successful exploitation of this vulnerability may cause the image decoding feature to perform abnormally.

CVE-2022-48353 [CRITICAL] CWE-269 CVE-2022-48353: Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.

CVE-2021-46894 [CRITICAL] CWE-269 CVE-2021-46894: Use After Free (UAF) vulnerability in the uinput module.Successful exploitation of this vulnerabilit Use After Free (UAF) vulnerability in the uinput module.Successful exploitation of this vulnerability may lead to kernel privilege escalation.

CVE-2023-41297 [CRITICAL] CVE-2023-41297: Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exp Vulnerability of defects introduced in the design process in the HiviewTunner module. Successful exploitation of this vulnerability may cause service hijacking.

CVE-2024-57959 [CRITICAL] CWE-416 CVE-2024-57959: Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vul Use-After-Free (UAF) vulnerability in the display module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2021-37087 [CRITICAL] CWE-22 CVE-2021-37087: There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnera There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can create arbitrary file.

CVE-2021-37088 [CRITICAL] CWE-22 CVE-2021-37088: There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnera There is a Path Traversal vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to attackers can write any content to any file.

CVE-2021-40053 [CRITICAL] CWE-276 CVE-2021-40053: There is a permission control vulnerability in the Nearby module.Successful exploitation of this vul There is a permission control vulnerability in the Nearby module.Successful exploitation of this vulnerability will affect availability and integrity.