PT-2022-26447 · Unknown · Openharmony

Published 2022-10-14 · Updated 2022-10-18 · CVE-2022-42464

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenHarmony versions 3.1.2 and prior OpenHarmony versions 3.0.6 and prior

Description The issue is related to a Kernel memory pool override vulnerability in the /dev/mmz userdev device driver. The impact depends on the privileges of the attacker. An unprivileged process could disclose sensitive information, including kernel pointers, which could be used in further attacks. Processes with system user UID could mmap memory pools used by the kernel and override them, potentially gaining kernel code execution, root privileges, or causing a device reboot.

Recommendations For OpenHarmony versions 3.1.2 and prior, consider restricting access to the /dev/mmz userdev device driver to minimize the risk of exploitation. For OpenHarmony versions 3.0.6 and prior, consider restricting access to the /dev/mmz userdev device driver to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2022-42464

Affected Products

Openharmony

References · 4

• https://osv.dev/vulnerability/CVE-2022-42464 · Vendor Advisory
• https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42464 · Security Note
• https://t.me/cibsecurity/51432 · Telegram Post