Huawei Harmonyos vulnerabilities

CVE-2021-46890 [CRITICAL] CWE-863 CVE-2021-46890: Vulnerability of incomplete read and write permission verification in the GPU module. Successful exp Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability.

CVE-2021-37011 [CRITICAL] CWE-787 CVE-2021-37011: There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Out-of-bounds read.

CVE-2021-37064 [CRITICAL] CWE-22 CVE-2021-37064: There is a Improper Limitation of a Pathname to a Restricted Directory vulnerability in Huawei Smart There is a Improper Limitation of a Pathname to a Restricted Directory vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to arbitrary file created.

CVE-2021-22394 [CRITICAL] CWE-120 CVE-2021-22394: There is a buffer overflow vulnerability in smartphones. Successful exploitation of this vulnerabili There is a buffer overflow vulnerability in smartphones. Successful exploitation of this vulnerability may cause DoS of the apps during Multi-Screen Collaboration.

CVE-2021-37021 [CRITICAL] CWE-787 CVE-2021-37021: There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Out-of-bounds read.

CVE-2021-37020 [CRITICAL] CWE-787 CVE-2021-37020: There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of There is a Stack-based Buffer Overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to Out-of-bounds read.

CVE-2021-37079 [CRITICAL] CWE-94 CVE-2021-37079: There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of t There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to delete arbitrary file by system_app permission.

CVE-2022-31760 [CRITICAL] CVE-2022-31760: Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploitation of this vulnerability may affect data integrity and confidentiality.

CVE-2023-44107 [CRITICAL] CVE-2023-44107: Vulnerability of defects introduced in the design process in the screen projection module.Successfu Vulnerability of defects introduced in the design process in the screen projection module.Successful exploitation of this vulnerability may affect service availability and integrity.

CVE-2022-48290 [CRITICAL] CWE-693 CVE-2022-48290: The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this The phone-PC collaboration module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect data confidentiality and integrity.

CVE-2023-5801 [CRITICAL] CWE-290 CVE-2023-5801: Vulnerability of identity verification being bypassed in the face unlock module. Successful exploita Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confidentiality.

CVE-2023-52106 [CRITICAL] CWE-264 CVE-2023-52106: Vulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Succes Vulnerability of permission verification for APIs in the DownloadProviderMain module. Impact: Successful exploitation of this vulnerability will affect integrity and availability.

CVE-2024-57958 [CRITICAL] CWE-125 CVE-2024-57958: Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vu Out-of-bounds array read vulnerability in the FFRT module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally.

CVE-2021-40002 [HIGH] CWE-787 CVE-2021-40002: The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulne The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulnerability may result in malicious command execution at the remote end.

CVE-2021-40000 [HIGH] CWE-787 CVE-2021-40000: The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulne The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulnerability may result in malicious command execution at the remote end.

CVE-2021-37074 [HIGH] CWE-362 CVE-2021-37074: There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnera There is a Race Condition vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to the user root privilege escalation.

CVE-2021-40036 [CRITICAL] CWE-787 CVE-2021-40036: The bone voice ID TA has a memory overwrite vulnerability. Successful exploitation of this vulnerabi The bone voice ID TA has a memory overwrite vulnerability. Successful exploitation of this vulnerability may result in malicious code execution.

CVE-2021-46740 [HIGH] CWE-287 CVE-2021-46740: The device authentication service module has a defect vulnerability introduced in the design process The device authentication service module has a defect vulnerability introduced in the design process.Successful exploitation of this vulnerability may affect data confidentiality.

CVE-2022-22258 [CRITICAL] CVE-2022-22258: The Wi-Fi module has an event notification vulnerability.Successful exploitation of this vulnerabili The Wi-Fi module has an event notification vulnerability.Successful exploitation of this vulnerability may allow third-party applications to intercept event notifications and add information and result in elevation-of-privilege.

CVE-2021-22429 [CRITICAL] CWE-119 CVE-2021-22429: There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerabilit There is a memory address out of bounds in smartphones. Successful exploitation of this vulnerability may cause malicious code to be executed.