Lucene search

[email protected]CVE-2022-48518

HistoryJul 06, 2023 - 1:15 p.m.

CVE-2022-48518

2023-07-0613:15:10

CWE-665

CWE-701

[email protected]

web.nvd.nist.gov

cve-2022-48518

vulnerability

iaware system

signature verification

exploit

package spoofing

system performance

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Vulnerability of signature verification in the iaware system being initialized later than the time when the system broadcasts are sent. Successful exploitation of this vulnerability may cause malicious apps to start upon power-on by spoofing the package names of apps in the startup trustlist, which affects system performance.

Affected configurations

NVD

Node

huaweiemuiMatch12.0.0

huaweiemuiMatch12.0.1

huaweiharmonyosMatch2.0.0

huaweiharmonyosMatch2.0.1

CPENameOperatorVersion
huawei:emuihuawei emuieq12.0.0
huawei:emuihuawei emuieq12.0.1
huawei:harmonyoshuawei harmonyoseq2.0.0
huawei:harmonyoshuawei harmonyoseq2.0.1

CPE	Name	Operator	Version
huawei:emui	huawei emui	eq	12.0.0
huawei:emui	huawei emui	eq	12.0.1
huawei:harmonyos	huawei harmonyos	eq	2.0.0
huawei:harmonyos	huawei harmonyos	eq	2.0.1

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "HarmonyOS",
    "vendor": "Huawei",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.0"
      },
      {
        "status": "affected",
        "version": "2.0.1"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "EMUI",
    "vendor": "Huawei",
    "versions": [
      {
        "status": "affected",
        "version": "12.0.0"
      },
      {
        "status": "affected",
        "version": "12.0.1"
      }
    ]
  }
]

References

consumer.huawei.com/en/support/bulletin/2023/7/

device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

5.3 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Related for CVE-2022-48518

nvd1 prion1 cvelist1