CVE-2022-42464: Kernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in furth ...
OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmzuserdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in further attacks. The processes with system user UID run on the device would be able to mmap memory pools used by kernel and override them which could be used to gain kernel code execution on the device, gain root privileges, or cause device reboot.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-42464?
CVE-2022-42464 is a vulnerability in OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions, that allows an attacker to override the kernel memory pool in the /dev/mmz_userdev device driver.
What is the impact of CVE-2022-42464?
The impact of CVE-2022-42464 depends on the privileges of the attacker, where an unprivileged process can disclose sensitive information, including kernel details.
Which software versions are affected by CVE-2022-42464?
OpenHarmony-v3.0 to v3.0.6 and OpenHarmony-v3.1 to v3.1.2 are affected by CVE-2022-42464.
What is the severity of CVE-2022-42464?
CVE-2022-42464 has a severity rating of 7.8 (high).
How can I fix CVE-2022-42464?
To fix CVE-2022-42464, it is recommended to update OpenHarmony to version 3.0.7 or later for the 3.0.x branch and version 3.1.3 or later for the 3.1.x branch.