HarmonyOS vulnerabilities
234 known vulnerabilities in HarmonyOS from Huawei. 234 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
HarmonyOS: Concurrent Execution using Shared Resource with Improper Synchronization
The iaware module has a vulnerability in thread security. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
- 7.5 High severity
HarmonyOS: Use After Free
The graphics display module has a UAF vulnerability when traversing graphic layers. Successful exploitation of this vulnerability may affect system availability.
- 7.5 High severity
HarmonyOS: Missing Authorization
The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to access the geofencing APIs without authorization, affecting user confidentiality.
- 7.5 High severity
HarmonyOS: Incomplete Cleanup
The kernel module has the vulnerability that the mapping is not cleared after the memory is automatically released. Successful exploitation of this vulnerability may cause a system restart.
- 7.5 High severity
HarmonyOS: Improper Check or Handling of Exceptional Conditions
The DFX unwind stack module of the ArkCompiler has a vulnerability in interface calling.Successful exploitation of this vulnerability affects system services and device availability.
- 7.5 High severity
HarmonyOS: Improper Handling of Length Parameter Inconsistency
The communication framework module has a vulnerability of not truncating data properly.Successful exploitation of this vulnerability may affect data confidentiality.
- 7.5 High severity
HarmonyOS: Out-of-bounds Read
The storage maintenance and debugging module has an array out-of-bounds read vulnerability.Successful exploitation of this vulnerability will cause incorrect statistics of this module.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Read
The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Read
The HW_KEYMASTER module has a vulnerability of not verifying the data read.Successful exploitation of this vulnerability may cause malicious construction of data, which results in out-of-bounds access.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Write
The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation attacks implemented by modifying program information.
- 7.1 High severity
HarmonyOS: Out-of-bounds Read
The kernel server has a vulnerability of not verifying the length of the data transferred in the user space.Successful exploitation of this vulnerability may cause out-of-bounds read in the kernel, which affects the device confidentiality and availability.
- 7.8 High severity
HarmonyOS: Improper Control of Generation of Code
The rphone module has a script that can be maliciously modified.Successful exploitation of this vulnerability may cause irreversible programs to be implanted on user devices.
- 7.5 High severity
HarmonyOS: Protection Mechanism Failure
The HISP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause unauthorized access to the HISP module.
- 7.5 High severity
HarmonyOS: Out-of-bounds Read
The HISP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability will cause out-of-bounds read, which affects data confidentiality.
- 9.1 Critical severity
HarmonyOS: Out-of-bounds Write
The HIPP module has a vulnerability of bypassing the check of the data transferred in the kernel space.Successful exploitation of this vulnerability may cause out-of-bounds access to the HIPP module and page table tampering, affecting device confidentiality an
- 7.5 High severity
HarmonyOS: Out-of-bounds Read
The HIPP module has a vulnerability of not verifying the data transferred in the kernel space.Successful exploitation of this vulnerability will cause out-of-bounds read, which affects data confidentiality.
- 9.8 Critical severity
HarmonyOS: Use After Free
The BT Hfp Client module has a Use-After-Free (UAF) vulnerability.Successful exploitation of this vulnerability may result in arbitrary code execution.
- 9.8 Critical severity
HarmonyOS: Out-of-bounds Write
The HwAirlink module has a heap overflow vulnerability in processing data packets of the proprietary protocol.Successful exploitation of this vulnerability may allow attackers to obtain process control permissions.
- 7.5 High severity
HarmonyOS: Out-of-bounds Write
The HwAirlink module has a heap overflow vulnerability.Successful exploitation of this vulnerability may cause out-of-bounds writes, resulting in modification of sensitive data.
- 9.8 Critical severity
HarmonyOS: Improper Authentication
The WLAN module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause third-party apps to affect WLAN functions.
- 9.1 Critical severity
HarmonyOS: Deserialization of Untrusted Data
The NFC module has bundle serialization/deserialization vulnerabilities. Successful exploitation of this vulnerability may cause third-party apps to read and write files that are accessible only to system apps.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
The location module has a vulnerability of bypassing permission verification.Successful exploitation of this vulnerability may cause privilege escalation.
- 7.5 High severity
HarmonyOS: Insufficient Verification of Data Authenticity
The recovery module has a vulnerability of bypassing the verification of an update package before use. Successful exploitation of this vulnerability may affect system stability.
- 9.8 Critical severity
HarmonyOS: Incorrect Default Permissions
The AOD module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may cause permission escalation and unauthorized access to files.
- 9.8 Critical severity
HarmonyOS: Improper Privilege Management
The SystemUI module has a privilege escalation vulnerability. Successful exploitation of this vulnerability can cause malicious applications to pop up windows or run in the background.
- 7.5 High severity
HarmonyOS: Out-of-bounds Read
The AT commands of the USB port have an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect system availability.
- 9.1 Critical severity
HarmonyOS: Incorrect Default Permissions
The application security module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may affect data integrity and confidentiality.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
- 7.5 High severity
HarmonyOS: Use of Externally-Controlled Format String
The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability.
- 7.5 High severity
HarmonyOS: NULL Pointer Dereference
The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
- 9.8 Critical severity
HarmonyOS: Use After Free
The frame scheduling module has a Use After Free (UAF) vulnerability.Successful exploitation of this vulnerability will affect data integrity, availability, and confidentiality.
- 7.5 High severity
HarmonyOS: Improper Privilege Management
The customization framework has a vulnerability of improper permission control.Successful exploitation of this vulnerability may affect data integrity.
- 7.5 High severity
HarmonyOS: Improper Validation of Integrity Check Value
The DFX module has a vulnerability of improper validation of integrity check values.Successful exploitation of this vulnerability may affect system stability.