Paper/Archive/CVE-2022-38980

CVE-2022-38980

Huawei HarmonyOS — The HwAirlink module has a heap overflow vulnerability in processing data packets of the proprietary protocol.Successful exploitation of…

EPSS 0.6%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 50.5.505 × 2010.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The HwAirlink module has a heap overflow vulnerability in processing data packets of the proprietary protocol.Successful exploitation of this vulnerability may allow attackers to obtain process control permissions.

Affected

ProductAffectedFixed inSource

HarmonyOS2.0–CNA

HarmonyOS2.1–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdevice.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697