![Advisory Published](https://public.secalerts.co/assets/images/icon-advisory-published.svg)
11/10/2022
![Updated](https://public.secalerts.co/assets/images/icon-updated.svg)
3/8/2024
CVE-2022-42464: Kernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in furth ...
First published: Tue Oct 11 2022(Updated: )
OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions have a Kernel memory pool override vulnerability in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in further attacks. The processes with system user UID run on the device would be able to mmap memory pools used by kernel and override them which could be used to gain kernel code execution on the device, gain root privileges, or cause device reboot.
Credit: scy@openharmony.io
Affected Software | Affected Version | How to fix |
---|
Openharmony Openharmony | >=3.0<=3.0.6 | |
Openharmony Openharmony | >=3.1<=3.1.2 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2022-42464?
CVE-2022-42464 is a vulnerability in OpenHarmony-v3.1.2 and prior versions, 3.0.6 and prior versions, that allows an attacker to override the kernel memory pool in the /dev/mmz_userdev device driver.
What is the impact of CVE-2022-42464?
The impact of CVE-2022-42464 depends on the privileges of the attacker, where an unprivileged process can disclose sensitive information, including kernel details.
Which software versions are affected by CVE-2022-42464?
OpenHarmony-v3.0 to v3.0.6 and OpenHarmony-v3.1 to v3.1.2 are affected by CVE-2022-42464.
What is the severity of CVE-2022-42464?
CVE-2022-42464 has a severity rating of 7.8 (high).
How can I fix CVE-2022-42464?
To fix CVE-2022-42464, it is recommended to update OpenHarmony to version 3.0.7 or later for the 3.0.x branch and version 3.1.3 or later for the 3.1.x branch.
- collector/nvd-index
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/tags
- vendor/openharmony
- canonical/openharmony openharmony
- version/openharmony openharmony/3.0
- version/openharmony openharmony/3.0.6
- version/openharmony openharmony/3.1
- version/openharmony openharmony/3.1.2
Contact
SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.coBy using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203