Huawei Harmonyos vulnerabilities

CVE-2021-22295 [MEDIUM] CWE-276 CVE-2021-22295: A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this A component of the HarmonyOS has a permission bypass vulnerability. Local attackers may exploit this vulnerability to cause the device to hang due to the page error OsVmPageFaultHandler.

CVE-2021-22418 [HIGH] CWE-190 CVE-2021-22418: A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause memory overwriting.

CVE-2021-22420 [HIGH] CWE-668 CVE-2021-22420: A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause the underlying trust of the application trustlist mechanism is missing..

CVE-2021-22422 [HIGH] CWE-190 CVE-2021-22422: A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may A component of the HarmonyOS has a Integer Overflow or Wraparound vulnerability. Local attackers may exploit this vulnerability to cause memory overwriting.

CVE-2021-22421 [HIGH] CWE-269 CVE-2021-22421: A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to cause further Elevation of Privileges.

CVE-2021-22425 [HIGH] CWE-415 CVE-2021-22425: A component of the HarmonyOS has a Double Free vulnerability. Local attackers may exploit this vulne A component of the HarmonyOS has a Double Free vulnerability. Local attackers may exploit this vulnerability to cause Root Elevating Privileges.

CVE-2021-22423 [HIGH] CWE-787 CVE-2021-22423: A component of the HarmonyOS has a Out-of-bounds Write Vulnerability. Local attackers may exploit th A component of the HarmonyOS has a Out-of-bounds Write Vulnerability. Local attackers may exploit this vulnerability to cause integer overflow.

CVE-2021-22416 [HIGH] CVE-2021-22416: A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel Code Execution.

CVE-2021-22424 [MEDIUM] CWE-401 CVE-2021-22424: A component of the HarmonyOS has a Kernel Memory Leakage Vulnerability. Local attackers may exploit A component of the HarmonyOS has a Kernel Memory Leakage Vulnerability. Local attackers may exploit this vulnerability to cause Kernel Denial of Service.

CVE-2021-22419 [MEDIUM] CWE-345 CVE-2021-22419: A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Loc A component of the HarmonyOS has a Insufficient Verification of Data Authenticity vulnerability. Local attackers may exploit this vulnerability to cause persistent dos.

CVE-2021-22417 [MEDIUM] CVE-2021-22417: A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit A component of the HarmonyOS has a Data Processing Errors vulnerability. Local attackers may exploit this vulnerability to cause Kernel Memory Leakage.

CVE-2021-22318 [MEDIUM] CWE-476 CVE-2021-22318: A component of the HarmonyOS 2.0 has a Null Pointer Dereference Vulnerability. Local attackers may e A component of the HarmonyOS 2.0 has a Null Pointer Dereference Vulnerability. Local attackers may exploit this vulnerability to cause system denial of service.

CVE-2021-22326 [HIGH] CWE-269 CVE-2021-22326: A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. Local attacke A component of the HarmonyOS has a Privilege Dropping / Lowering Errors vulnerability. Local attackers may exploit this vulnerability to obtain Kernel space read/write capability.

CVE-2021-22376 [HIGH] CWE-269 CVE-2021-22376: A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may A component of the HarmonyOS has a Improper Privilege Management vulnerability. Local attackers may exploit this vulnerability to bypass user restrictions.

CVE-2021-22296 [MEDIUM] CVE-2021-22296: A component of HarmonyOS 2.0 has a DoS vulnerability. Local attackers may exploit this vulnerability A component of HarmonyOS 2.0 has a DoS vulnerability. Local attackers may exploit this vulnerability to mount a file system to the target device, causing DoS of the file system.

CVE-2021-22294 [LOW] CVE-2021-22294: A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may expl A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerability to issue commands repeatedly, exhausting system service resources.