Vulnerabilities > CVE-2022-41802 - Out-of-bounds Write vulnerability in multiple products

CVSS 3.3 - LOW

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

LOW

local

low complexity

openharmony

openatom

CWE-787

NVD

Published: 2022-12-08

Updated: 2024-09-09

Summary

Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGetres. 4 bytes padding data from kernel stack are copied to user space incorrectly and leaked.

Vulnerable Configurations

Part	Description	Count
Application	Openharmony Openharmony Openharmony 3.1 Openharmony Openharmony 3.1.1 Openharmony Openharmony 3.1.2 Openharmony Openharmony 3.1.3 Openharmony Openharmony 3.1.4	11
OS	Openatom Openatom Openharmony 3.0 Openatom Openharmony 3.0.1 Openatom Openharmony 3.0.2 Openatom Openharmony 3.0.3 Openatom Openharmony 3.0.5 Openatom Openharmony 3.0.6 Openatom Openharmony 1.1.0 Openatom Openharmony 1.1.1 Openatom Openharmony 1.1.2 Openatom Openharmony 1.1.3 Openatom Openharmony 1.1.4 Openatom Openharmony 1.1.5	12

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

References

https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.md