CVE-2022-42464

🗓️ 14 Oct 2022 14:40:12Reported by OpenHarmonyType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 46 Views🌐 WEB

CVE-2022-42464 OpenHarmony-v3.1.2 prior versions have Kernel memory pool override vulnerability in /dev/mmz_userdev driver. Impact varies with attacker privileges

Reporter	Title	Published	Views	Family All 9
Circl	CVE-2022-42464	14 Oct 202218:29	–	circl
CNNVD	OpenHarmony 安全漏洞	14 Oct 202200:00	–	cnnvd
Cvelist	CVE-2022-42464 Kernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in furth ...	14 Oct 202214:40	–	cvelist
EUVD	EUVD-2022-45537	3 Oct 202520:07	–	euvd
NVD	CVE-2022-42464	14 Oct 202215:16	–	nvd
OSV	CVE-2022-42464	14 Oct 202215:16	–	osv
Prion	Design/Logic Flaw	14 Oct 202215:16	–	prion
Positive Technologies	PT-2022-26447 · Unknown · Openharmony	14 Oct 202200:00	–	ptsecurity
Vulnrichment	CVE-2022-42464 Kernel memory pool override in /dev/mmz_userdev device driver. The impact depends on the privileges of the attacker. The unprivileged process run on the device could disclose sensitive information including kernel pointer, which could be used in furth ...	14 Oct 202214:40	–	vulnrichment

NVD

Node

openharmony openharmonyRange3.0–3.0.6

openharmony openharmonyRange3.1–3.1.2

[
  {
    "vendor": "OpenHarmony",
    "product": "OpenHarmony",
    "versions": [
      {
        "version": "OpenHarmony-v3.1.x-Release",
        "status": "affected",
        "lessThanOrEqual": "3.1.2",
        "versionType": "custom"
      },
      {
        "version": "OpenHarmony-v3.0.x-LTS",
        "status": "affected",
        "lessThanOrEqual": "3.0.6",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gitee	www.gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-10.md

Parameter	Position	Path	Description	CWE
mmap	path	/dev/mmz_userdev	Kernel memory pool override vulnerability in /dev/mmz_userdev allowing unprivileged processes to mmap kernel memory pools, potentially disclosing kernel pointers and escalating to kernel code execution / root privileges.	CWE-276