VulnerabilityModified

CVE-2022-44455

The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation.

HIGH 7.8EPSS 0.21%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.21%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. An unprivileged malicious application would be able to gain code execution within any application installed on the device or cause application crash.

CVSS 3.1: 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.21% probability · 11th percentile
CISA KEV: Not listed
Weakness: CWE-120
Affected: openharmony/openharmony · openatom/openharmony
Source: scy@openharmony.io

References

https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.mdThird Party Advisory
https://gitee.com/openharmony/security/blob/master/en/security-disclosure/2022/2022-12.mdThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.