CVE-2022-42464: Kernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in furth ...
First published: Fri Oct 14 2022(Updated: )
OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in further attacks. The processes with system user UID run on the device would be able to mmap memory pools used by kernel and override them which could be used to gain kernel code execution on the device, gain root privileges, or cause device reboot.
Credit: scy@openharmony.io
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Openharmony Openharmony | >=3.0<=3.0.6 | |
| Openharmony Openharmony | >=3.1<=3.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2022-42464?
CVE-2022-42464 is a vulnerability in OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions, that allows an attacker to override the kernel memory pool in the /dev/mmz_userdev device driver.
What is the impact of CVE-2022-42464?
The impact of CVE-2022-42464 depends on the privileges of the attacker, where an unprivileged process can disclose sensitive information, including kernel details.
Which software versions are affected by CVE-2022-42464?
OpenHarmony-v3.0 to v3.0.6 and OpenHarmony-v3.1 to v3.1.2 are affected by CVE-2022-42464.
What is the severity of CVE-2022-42464?
CVE-2022-42464 has a severity rating of 7.8 (high).
How can I fix CVE-2022-42464?
To fix CVE-2022-42464, it is recommended to update OpenHarmony to version 3.0.7 or later for the 3.0.x branch and version 3.1.3 or later for the 3.1.x branch.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/openharmony
- canonical/openharmony openharmony
- version/openharmony openharmony/3.0
- version/openharmony openharmony/3.0.6
- version/openharmony openharmony/3.1
- version/openharmony openharmony/3.1.2