diff --git a/en/security-disclosure/2021/2021-03.md b/en/security-disclosure/2021/2021-03.md index 5e75811acdd6d05f236d65756c66aa83a905c21c..c64260c0c78166528c289ce6b80ac186c0747825 100644 --- a/en/security-disclosure/2021/2021-03.md +++ b/en/security-disclosure/2021/2021-03.md @@ -1,7 +1,8 @@ ## Security Vulnerabilities in March 2021 - +_Published March 1,2021_
+_updated July 15,2022_ | Vulnerability ID | related Vulnerability | Vulnerability Descripton | Vulnerability Impact | affected versions | affected projects| fix link | reference | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2021-0301 | NA | The component distributedschedule_services_samgr_lite has a permission bypass vulnerability.| This vulnerability can be exploited to bypass the authentication of system services, causing Elevation Of Privilege. |OpenHarmony-1.0|distributedschedule_services_samgr_lite| [Link](https://gitee.com/openharmony/distributedschedule_samgr_lite/pulls/7/files) |Reported by OpenHarmony Team| -|OpenHarmony-SA-2021-0302 | NA | The componet kernel_liteos_a has a DoS vulnerability. | This vulnerability can be exploited to interrupt system signals in calling application layer interface, may cause DoS attacks.|OpenHarmony-1.0|kernel_liteos_a| [Link](https://gitee.com/openharmony/kernel_liteos_a/pulls/48/files)|Reported by OpenHarmony Team| +|OpenHarmony-SA-2021-0301 | NA | The component distributedschedule_services_samgr_lite has a permission bypass vulnerability.| This vulnerability can be exploited to bypass the authentication of system services, causing Elevation Of Privilege. |OpenHarmony-1.0(master)|distributedschedule_services_samgr_lite| [master](https://gitee.com/openharmony/distributedschedule_samgr_lite/pulls/7/files) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2021-0302 | NA | The componet kernel_liteos_a has a DoS vulnerability. | This vulnerability can be exploited to interrupt system signals in calling application layer interface, may cause DoS attacks.|OpenHarmony-1.0(master)|kernel_liteos_a| [master](https://gitee.com/openharmony/kernel_liteos_a/pulls/48/files)|Reported by OpenHarmony Team| diff --git a/en/security-disclosure/2021/2021-08.md b/en/security-disclosure/2021/2021-08.md index 412a9aa74a260673355e60a11eaa06ef9679b41f..1e50e02a52e18ba6dffa772b8a94691ddd1830c9 100644 --- a/en/security-disclosure/2021/2021-08.md +++ b/en/security-disclosure/2021/2021-08.md @@ -1,6 +1,7 @@ ## Security Vulnerabilities in August 2021 - +_Published August 4,2021_
+_updated July 15,2022_ | Vulnerability ID | related Vulnerability | Vulnerability Descripton | Vulnerability Impact | affected versions | affected projects| fix link | reference | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2021-0801 | NA | The component drivers_adapter_khdf_linux has an integer overflow vulnerability.| This vulnerability can be exploited to apply large memory, causing Dos attacks.|OpenHarmony_1.0.1_release|drivers_adapter_khdf_linux| [Link](https://gitee.com/openharmony/drivers_adapter_khdf_linux/pulls/28/files) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2021-0801 | NA | The component drivers_adapter_khdf_linux has an integer overflow vulnerability.| This vulnerability can be exploited to apply large memory, causing Dos attacks.|OpenHarmony_release_v1.1.0
OpenHarmony-v1.1.1-LTS|drivers_adapter_khdf_linux| [1.1.x](https://gitee.com/openharmony/drivers_adapter_khdf_linux/pulls/28/files) |Reported by OpenHarmony Team| diff --git a/en/security-disclosure/2021/2021-09.md b/en/security-disclosure/2021/2021-09.md index 0b40468678db208e2a25c4855eeffe4f4e901ab4..8e94c27fcf24d0275e9ae584fbf8e4895ffb6f52 100644 --- a/en/security-disclosure/2021/2021-09.md +++ b/en/security-disclosure/2021/2021-09.md @@ -1,8 +1,9 @@ ## Security Vulnerabilities in September 2021 - +_Published September 1,2021_
+_updated July 15,2022_ | Vulnerability ID | related Vulnerability | Vulnerability Descripton | Vulnerability Impact | affected versions | affected projects| fix link | reference | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2021-0901 | NA | The component distributedschedule_samgr_lite has a UAF vulnerability.|This vulnerability can be exploited to bypass verification when calling an SA.|OpenHarmony-v2.2(Trunk)|distributedschedule_samgr_lite| [Link](https://gitee.com/openharmony/distributedschedule_samgr_lite/pulls/24/files) |Reported by OpenHarmony Team| -|OpenHarmony-SA-2021-0902 | NA | The component kernel_liteos_a has an invalid address access vulnerability.|This vulnerability can be exploited to write to illegal address in kernel, causing Remote Code Execute. |OpenHarmony-v2.2(Trunk)|kernel_liteos_a| [Link](https://gitee.com/openharmony/kernel_liteos_a/pulls/373/files) |Reported by OpenHarmony Team| -|OpenHarmony-SA-2021-0903 | NA | The component drivers_adapter has an integer overflow vulnerability.|This vulnerability can be exploited to apply large memory, causing Dos attacks.|OpenHarmony-v2.2(Trunk)|drivers_adapter| [Link](https://gitee.com/openharmony/drivers_adapter/pulls/31/files) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2021-0901 | NA | The component distributedschedule_samgr_lite has a UAF vulnerability.|This vulnerability can be exploited to bypass verification when calling an SA.|OpenHarmony_release_v1.1.0
OpenHarmony-v1.1.1-LTS|distributedschedule_samgr_lite| [1.1.x](https://gitee.com/openharmony/distributedschedule_samgr_lite/pulls/24/files) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2021-0902 | NA | The component kernel_liteos_a has an invalid address access vulnerability.|This vulnerability can be exploited to write to illegal address in kernel, causing Remote Code Execute. |OpenHarmony_release_v1.1.0
OpenHarmony-v1.1.1-LTS|kernel_liteos_a| [1.1.x](https://gitee.com/openharmony/kernel_liteos_a/pulls/373/files) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2021-0903 | NA | The component drivers_adapter has an integer overflow vulnerability.|This vulnerability can be exploited to apply large memory, causing Dos attacks.|OpenHarmony_release_v1.1.0
OpenHarmony-v1.1.1-LTS|drivers_adapter| [1.1.x](https://gitee.com/openharmony/drivers_adapter/pulls/31/files) |Reported by OpenHarmony Team| diff --git a/en/security-disclosure/2022/2022-05.md b/en/security-disclosure/2022/2022-05.md index 1ceb5df54d9b47c516fcda86e546134d10ca95f8..fa54f10fb28559704271a3362b99c29bbb1aa73a 100644 --- a/en/security-disclosure/2022/2022-05.md +++ b/en/security-disclosure/2022/2022-05.md @@ -1,32 +1,33 @@ ## Security Vulnerabilities in May 2022 -_published May 6,2022_ +_published May 6,2022_
+_updated July 15,2022_ | Vulnerability ID | related Vulnerability | Vulnerability Descripton | Vulnerability Impact | affected versions | affected projects| fix link | reference | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2022-0501 | NA | The softbus subsystem in OpenHarmony has a heap overflow vulnerability. | Local attackers can overwrite the memory and get system control. |OpenHarmony-3.0-LTS|communication_dsoftbus| [Link](https://gitee.com/openharmony/communication_dsoftbus/pulls/1198) |Reported by OpenHarmony Team| -|OpenHarmony-SA-2022-0502 | NA | The softbus subsystem in OpenHarmony has a heap overflow vulnerability when receive a tcp message. | LAN attackers can lead to remote code execution(RCE) and get system control. |OpenHarmony-3.0-LTS|communication_dsoftbus| [Link](https://gitee.com/openharmony/communication_dsoftbus/pulls/1113) |Reported by OpenHarmony Team| -|OpenHarmony-SA-2022-0503 | NA | The softbus subsystem in OpenHarmony has an out-of-bounds access vulnerability when handle a synchronized message from another device. | Local attackers can elevate permissions to SYSTEM. |OpenHarmony-3.0-LTS|communication_dsoftbus| [Link](https://gitee.com/openharmony/communication_dsoftbus/pulls/1369) |Reported by OpenHarmony Team| -|OpenHarmony-SA-2022-0504 | NA | The calss Lock in OpenHarmony has a double free vulnerability. | Local attackers can elevate permissions to SYSTEM. |OpenHarmony-3.0-LTS|global_resmgr_standard| [Link](https://gitee.com/openharmony/global_resmgr_standard/pulls/136) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2022-0501 | NA | The softbus subsystem in OpenHarmony has a heap overflow vulnerability. | Local attackers can overwrite the memory and get system control. |OpenHarmony-3.0-LTS|communication_dsoftbus| [3.0.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/1372) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2022-0502 | NA | The softbus subsystem in OpenHarmony has a heap overflow vulnerability when receive a tcp message. | LAN attackers can lead to remote code execution(RCE) and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release through OpenHarmony-v3.1.1-Release|communication_dsoftbus| [3.0.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/1369)
[3.1.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/1807) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2022-0503 | NA | The softbus subsystem in OpenHarmony has an out-of-bounds access vulnerability when handle a synchronized message from another device. | Local attackers can elevate permissions to SYSTEM. |OpenHarmony-3.0-LTS|communication_dsoftbus| [3.0.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/1422) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2022-0504 | NA | The calss Lock in OpenHarmony has a double free vulnerability. | Local attackers can elevate permissions to SYSTEM. |OpenHarmony-3.0-LTS|global_resource_management| [3.0.x](https://gitee.com/openharmony/global_resource_management/pulls/136) |Reported by OpenHarmony Team| ### The following table lists the third-party library vulnerabilities with only the CVE, severity, and affected OpenHarmony versions provided. For more details, see the security bulletins released by third-parties. | CVE | severity | affected OpenHarmony versions | fix link | | --- | -------- | ----------------------------- | -------- | -| CVE-2022-0778 | Medium | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/third_party_openssl/pulls/34) | -| CVE-2018-25032 | High | OpenHarmony-1.0-LTS
OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/third_party_zlib/pulls/31)
[Link](https://gitee.com/openharmony/third_party_zlib/pulls/30) | -| CVE-2021-28714 | Medium | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/06639c05f98d596690a93b4179235f709fbdfffe) | -| CVE-2021-28715 | Medium | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/2938e8ac18d248567afe744760db99c77aff2253) | -| CVE-2022-23222 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/4e695c44106d3f0f9908ffb1c9593205bb7f80ed) | -| CVE-2022-0185 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/76a954013f985828558dc67851b1a455ae7d3421) | -| CVE-2021-22600 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/214329f8032e15f72d39ab3ecf95b5fab274fe1a) | -| CVE-2022-22942 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/9a967f71164cf3b3fc7874b5f1cc193b3819b402) | -| CVE-2022-0492 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/ea8f5c0c115c8c61a76b3dfa51cddb9c5c40fec4) | -| CVE-2022-24448 | Low | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/9e4a6ed92bb4e0b964c5e3fff63d20cf46eda38f)
[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/af9e3d1a2dc61aa346e33a287fb83c8c0d487881)
[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/51fef9de52b5b1431cac919c052f1e82f4cdfbae) | -| CVE-2022-0516 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/8ba71b83e7acfbbf351d3d5b10ced7a4f66c05c9) | -| CVE-2022-0617 | Medium | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/999c29733c45ac8864c64aa8b4b98df436327096)
[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/7d65b9dbe4277bac42eb649935cd02fdcd47cfe0) | -| CVE-2022-0847 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/b4e786c8ebae053b21583494b44f97e30b58ec3d) | -| CVE-2022-26490 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/141) | -| CVE-2022-25636 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/62e6212596777900936105d7dbc18ed2303026c0) | -| CVE-2022-26966 | Medium | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/4b80b2d8eba4d9df430b5b19096299b017541e1d) | -| CVE-2022-1011 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/013bad7096d7bee6a3beb0936060e07644fc251d) | -| CVE-2022-27223 | High | OpenHarmony-3.0-LTS |[Link](https://gitee.com/openharmony/kernel_linux_5.10/commit/5939446d63ddecefdbe31834c2ee00c5bc0514e2) | +| CVE-2022-0778 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/third_party_openssl/pulls/34) | +| CVE-2018-25032 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v1.1.0 through OpenHarmony-v1.1.4-LTS |[3.0.x](https://gitee.com/openharmony/third_party_zlib/pulls/30)
[1.1.x](https://gitee.com/openharmony/third_party_zlib/pulls/31) | +| CVE-2021-28714 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/06639c05f98d596690a93b4179235f709fbdfffe) | +| CVE-2021-28715 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/2938e8ac18d248567afe744760db99c77aff2253) | +| CVE-2022-23222 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/4e695c44106d3f0f9908ffb1c9593205bb7f80ed) | +| CVE-2022-0185 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/76a954013f985828558dc67851b1a455ae7d3421) | +| CVE-2021-22600 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/214329f8032e15f72d39ab3ecf95b5fab274fe1a) | +| CVE-2022-22942 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/9a967f71164cf3b3fc7874b5f1cc193b3819b402) | +| CVE-2022-0492 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/ea8f5c0c115c8c61a76b3dfa51cddb9c5c40fec4) | +| CVE-2022-24448 | Low | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/9e4a6ed92bb4e0b964c5e3fff63d20cf46eda38f)
[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/af9e3d1a2dc61aa346e33a287fb83c8c0d487881)
[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/51fef9de52b5b1431cac919c052f1e82f4cdfbae) | +| CVE-2022-0516 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/8ba71b83e7acfbbf351d3d5b10ced7a4f66c05c9) | +| CVE-2022-0617 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/999c29733c45ac8864c64aa8b4b98df436327096)
[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/7d65b9dbe4277bac42eb649935cd02fdcd47cfe0) | +| CVE-2022-0847 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/b4e786c8ebae053b21583494b44f97e30b58ec3d) | +| CVE-2022-26490 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/141) | +| CVE-2022-25636 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/62e6212596777900936105d7dbc18ed2303026c0) | +| CVE-2022-26966 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/4b80b2d8eba4d9df430b5b19096299b017541e1d) | +| CVE-2022-1011 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/013bad7096d7bee6a3beb0936060e07644fc251d) | +| CVE-2022-27223 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/5939446d63ddecefdbe31834c2ee00c5bc0514e2) | diff --git a/en/security-disclosure/2022/2022-06.md b/en/security-disclosure/2022/2022-06.md index 1834089bdb63331e3e9e0270728e8014d5049296..6af628463cc41bef510997912eb6c51fb9de0a2c 100644 --- a/en/security-disclosure/2022/2022-06.md +++ b/en/security-disclosure/2022/2022-06.md @@ -1,57 +1,58 @@ ## Security Vulnerabilities in June 2022 -_published June 6,2022_ +_published June 6,2022_
+_updated July 15,2022_ | Vulnerability ID | related Vulnerability | Vulnerability Descripton | Vulnerability Impact | affected versions | affected projects| fix link | reference | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2022-0601 | NA | The notification subsystem in OpenHarmony has an authentication bypass vulnerability when deserialize an object.| Local attackers can bypass authenication and crash the server process. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|notification_ces_standard| [Link](https://gitee.com/openharmony/notification_common_event_service/pulls/269) |Reported by OpenHarmony Team| -|OpenHarmony-SA-2022-0602 | NA | The notification subsystem in OpenHarmony has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|notification_ces_standard| [Link](https://gitee.com/openharmony/notification_common_event_service/pulls/245) |Reported by OpenHarmony Team| -|OpenHarmony-SA-2022-0603 | NA | The updateservice in OpenHarmony has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|update_updateservice| [Link](https://gitee.com/openharmony/update_updateservice/pulls/115) |Reported by OpenHarmony Team| -|OpenHarmony-SA-2022-0604 | NA | The multimedia subsystem in OpenHarmony has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|multimedia_media_standard| [Link](https://gitee.com/openharmony/multimedia_media_standard/pulls/567) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2022-0601 | NA | The notification subsystem in OpenHarmony has an authentication bypass vulnerability when deserialize an object.| Local attackers can bypass authenication and crash the server process. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release|notification_common_event_service| [3.0.x](https://gitee.com/openharmony/notification_common_event_service/pulls/269)
[3.1.x](https://gitee.com/openharmony/notification_common_event_service/pulls/288) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2022-0602 | NA | The notification subsystem in OpenHarmony has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|notification_common_event_service| [3.0.x](https://gitee.com/openharmony/notification_common_event_service/pulls/245) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2022-0603 | NA | The updateservice in OpenHarmony has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|update_updateservice| [3.0.x](https://gitee.com/openharmony/update_updateservice/pulls/115) |Reported by OpenHarmony Team| +|OpenHarmony-SA-2022-0604 | NA | The multimedia subsystem in OpenHarmony has an authentication bypass vulnerability which allows an "SA relay attack". | Local attackers can bypass authentication and get system control. |OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|multimedia_media_standard| [3.0.x](https://gitee.com/openharmony/multimedia_media_standard/pulls/567) |Reported by OpenHarmony Team| ### The following table lists the third-party library vulnerabilities with only the CVE, severity, and affected OpenHarmony versions provided. For more details, see the security bulletins released by third-parties. | CVE | severity | affected OpenHarmony versions | fix link | | --- | -------- | ---------------------- | ------- | -| CVE-2022-25313 | Medium | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS|[Link](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-25314 | High | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS|[Link](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-25315 | Medium | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS|[Link](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-25235 | High | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS|[Link](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-25236 | Critical | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS|[Link](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-23308 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.2-LTS|[Link](https://gitee.com/openharmony/third_party_libxml2/pulls/11) | -| CVE-2022-25375 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2022-25258 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2022-0435 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2022-24959 | Low | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2021-44879 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2022-24958 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2021-45402 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2021-4160 | Medium | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS|[Link](https://gitee.com/openharmony/third_party_openssl/pulls/29) | -| CVE-2022-0778 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/third_party_openssl/pulls/34) | -| CVE-2022-0886 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/143) | -| CVE-2022-1055 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-0995 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2021-39698 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-0494 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-1048 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-1016 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2021-39686 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-0500 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/163) | -| CVE-2022-28390 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-28389 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-28388 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-28893 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-1353 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-29156 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-28356 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2019-16089 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/152) | -| CVE-2021-4156 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/third_party_libsnd/pulls/10) | -| CVE-2022-22576 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/third_party_curl/pulls/52) | -| CVE-2022-27775 | Low | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/third_party_curl/pulls/52) | -| CVE-2022-27776 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/third_party_curl/pulls/52) | -| CVE-2022-27774 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS and OpenHarmony-v3.1-Release|[Link](https://gitee.com/openharmony/third_party_curl/pulls/52) | -| CVE-2021-3520 | Critical | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.2-LTS|[Link](https://gitee.com/openharmony/third_party_lz4/pulls/2) | -| CVE-2021-44732 | Critical | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS|[Link](https://gitee.com/openharmony/third_party_mbedtls/pulls/31) | -| CVE-2021-36690 | High | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS|[Link](https://gitee.com/openharmony/third_party_sqlite/pulls/4) | -| CVE-2021-3732 | Low | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS|[Link](https://gitee.com/openharmony/kernel_linux_5.10/pulls/180) | -| CVE-2021-22570 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.2-LTS|[Link](https://gitee.com/openharmony/third_party_protobuf/pulls/26) | -| CVE-2021-22569 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.2-LTS|[Link](https://gitee.com/openharmony/third_party_protobuf/pulls/27) | +| CVE-2022-25313 | Medium | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-25314 | High | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-25315 | Medium | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-25235 | High | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-25236 | Critical | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-23308 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.2-LTS |[3.0.x](https://gitee.com/openharmony/third_party_libxml2/pulls/11) | +| CVE-2022-25375 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2022-25258 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2022-0435 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2022-24959 | Low | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2021-44879 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2022-24958 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2021-45402 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2021-4160 | Medium | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_openssl/pulls/29) | +| CVE-2022-0778 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/third_party_openssl/pulls/34) | +| CVE-2022-0886 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/143) | +| CVE-2022-1055 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-0995 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2021-39698 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-0494 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-1048 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-1016 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2021-39686 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-0500 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/163) | +| CVE-2022-28390 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-28389 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-28388 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-28893 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-1353 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-29156 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-28356 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
3.1.x not fixed| +| CVE-2019-16089 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/152) | +| CVE-2021-4156 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_libsnd/pulls/10)
[3.1.x](https://gitee.com/openharmony/third_party_libsnd/pulls/11)| +| CVE-2022-22576 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_curl/pulls/52)
[3.1.x](https://gitee.com/openharmony/third_party_curl/pulls/51)| +| CVE-2022-27775 | Low | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_curl/pulls/52)
[3.1.x](https://gitee.com/openharmony/third_party_curl/pulls/51)| +| CVE-2022-27776 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_curl/pulls/52)
[3.1.x](https://gitee.com/openharmony/third_party_curl/pulls/51)| +| CVE-2022-27774 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_curl/pulls/52)
[3.1.x](https://gitee.com/openharmony/third_party_curl/pulls/51)| +| CVE-2021-3520 | Critical | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.2-LTS |[3.0.x](https://gitee.com/openharmony/third_party_lz4/pulls/2) | +| CVE-2021-44732 | Critical | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_mbedtls/pulls/31) | +| CVE-2021-36690 | High | OpenHarmony-v3.0-LTS and OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_sqlite/pulls/4) | +| CVE-2021-3732 | Low | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/180) | +| CVE-2021-22570 | High | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.2-LTS |[3.0.x](https://gitee.com/openharmony/third_party_protobuf/pulls/26) | +| CVE-2021-22569 | Medium | OpenHarmony-v3.0-LTS through OpenHarmony-v3.0.2-LTS |[3.0.x](https://gitee.com/openharmony/third_party_protobuf/pulls/27) | \ No newline at end of file diff --git a/zh/security-disclosure/2021/2021-03.md b/zh/security-disclosure/2021/2021-03.md index 2c79f00dc06f28f78bf527212e0207787848c07e..b7d325eacf2c6fdd9724d81d2f201974ce84ccfc 100644 --- a/zh/security-disclosure/2021/2021-03.md +++ b/zh/security-disclosure/2021/2021-03.md @@ -1,7 +1,8 @@ ## 2021年3月安全漏洞 - +_发布于2021.3.1_
+_最后更新于2022.7.15_ | 漏洞编号 | 相关漏洞 | 漏洞描述 | 漏洞影响 | 受影响的版本 | 受影响的仓库 | 修复链接 | 参考链接 | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2021-0301 | NA | distributedschedule_services_samgr_lite组件接口存在权限穿越漏洞。| 利用此漏洞，绕过系统服务的认证，可造成提权。|OpenHarmony-1.0|distributedschedule_services_samgr_lite| [链接](https://gitee.com/openharmony/distributedschedule_samgr_lite/pulls/7/files) | 本项目组上报 | -|OpenHarmony-SA-2021-0302 | NA | kernel_liteos_a组件接口存在DOS攻击漏洞。| 利用此漏洞，应用层接口可导致系统中断信号异常，可造成DOS攻击。|OpenHarmony-1.0|kernel_liteos_a| [链接](https://gitee.com/openharmony/kernel_liteos_a/pulls/48/files)| 本项目组上报 | +|OpenHarmony-SA-2021-0301 | NA | distributedschedule_services_samgr_lite组件接口存在权限穿越漏洞。| 利用此漏洞，绕过系统服务的认证，可造成提权。|OpenHarmony-1.0(master)|distributedschedule_services_samgr_lite| [master](https://gitee.com/openharmony/distributedschedule_samgr_lite/pulls/7/files) | 本项目组上报 | +|OpenHarmony-SA-2021-0302 | NA | kernel_liteos_a组件接口存在DOS攻击漏洞。| 利用此漏洞，应用层接口可导致系统中断信号异常，可造成DOS攻击。|OpenHarmony-1.0(master)|kernel_liteos_a| [master](https://gitee.com/openharmony/kernel_liteos_a/pulls/48/files)| 本项目组上报 | diff --git a/zh/security-disclosure/2021/2021-08.md b/zh/security-disclosure/2021/2021-08.md index 0ba55e7a10e924741f55b773508ab38f2ca2e52c..102a028b63ed1de0c5b7352ed24218eed2af98ef 100644 --- a/zh/security-disclosure/2021/2021-08.md +++ b/zh/security-disclosure/2021/2021-08.md @@ -1,6 +1,7 @@ ## 2021年8月安全漏洞 - +_发布于2021.8.4__
+_最后更新于2022.7.15_ | 漏洞编号 | 相关漏洞 | 漏洞描述 | 漏洞影响 | 受影响的版本 | 受影响的仓库 | 修复链接 | 参考链接 | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2021-0801 | NA | drivers_adapter_khdf_linux组件接口存在整形溢出漏洞。| 利用此漏洞，申请超大内存，可造成DOS攻击。|OpenHarmony_1.0.1_release|drivers_adapter_khdf_linux| [链接](https://gitee.com/openharmony/drivers_adapter_khdf_linux/pulls/28/files) | 本项目组上报 | +|OpenHarmony-SA-2021-0801 | NA | drivers_adapter_khdf_linux组件接口存在整形溢出漏洞。| 利用此漏洞，申请超大内存，可造成DOS攻击。|OpenHarmony_release_v1.1.0
OpenHarmony-v1.1.1-LTS|drivers_adapter_khdf_linux| [1.1.x](https://gitee.com/openharmony/drivers_adapter_khdf_linux/pulls/28/files) | 本项目组上报 | diff --git a/zh/security-disclosure/2021/2021-09.md b/zh/security-disclosure/2021/2021-09.md index ecd057a287ee672e04a5881e77c242760ca1e84a..66a7193c7a96c55ba0bc52f666b7998bc94b637b 100644 --- a/zh/security-disclosure/2021/2021-09.md +++ b/zh/security-disclosure/2021/2021-09.md @@ -1,8 +1,9 @@ ## 2021年9月安全漏洞 - +_发布于2021.9.1_
+_最后更新于2022.7.15_ | 漏洞编号 | 相关漏洞 | 漏洞描述 | 漏洞影响 | 受影响的版本 | 受影响的仓库 | 修复链接 | 参考链接 | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2021-0901 | NA | distributedschedule_samgr_lite组件接口存在UAF漏洞。| 利用此漏洞，可在调用SA时绕过权限校验。|OpenHarmony-v2.2(主干)|distributedschedule_samgr_lite| [链接](https://gitee.com/openharmony/distributedschedule_samgr_lite/pulls/24/files) |本项目组上报| -|OpenHarmony-SA-2021-0902 | NA | kernel_liteos_a组件接口存在访问非法地址漏洞。| 利用此漏洞，越界写入内核非法地址，可造成任意代码执行。|OpenHarmony-v2.2(主干)|kernel_liteos_a| [链接](https://gitee.com/openharmony/kernel_liteos_a/pulls/373/files) |本项目组上报| -|OpenHarmony-SA-2021-0903 | NA | drivers_adapter组件接口存在整形溢出漏洞。| 利用此漏洞，申请超大内存，可造成DOS攻击。|OpenHarmony-v2.2(主干)|drivers_adapter| [链接](https://gitee.com/openharmony/drivers_adapter/pulls/31/files) |本项目组上报| +|OpenHarmony-SA-2021-0901 | NA | distributedschedule_samgr_lite组件接口存在UAF漏洞。| 利用此漏洞，可在调用SA时绕过权限校验。|OpenHarmony_release_v1.1.0
OpenHarmony-v1.1.1-LTS|distributedschedule_samgr_lite| [1.1.x](https://gitee.com/openharmony/distributedschedule_samgr_lite/pulls/24/files) |本项目组上报| +|OpenHarmony-SA-2021-0902 | NA | kernel_liteos_a组件接口存在访问非法地址漏洞。| 利用此漏洞，越界写入内核非法地址，可造成任意代码执行。|OpenHarmony_release_v1.1.0
OpenHarmony-v1.1.1-LTS|kernel_liteos_a| [1.1.x](https://gitee.com/openharmony/kernel_liteos_a/pulls/373/files) |本项目组上报| +|OpenHarmony-SA-2021-0903 | NA | drivers_adapter组件接口存在整形溢出漏洞。| 利用此漏洞，申请超大内存，可造成DOS攻击。|OpenHarmony_release_v1.1.0
OpenHarmony-v1.1.1-LTS|drivers_adapter| [1.1.x](https://gitee.com/openharmony/drivers_adapter/pulls/31/files) |本项目组上报| diff --git a/zh/security-disclosure/2022/2022-05.md b/zh/security-disclosure/2022/2022-05.md index 18cb1f3c47b186f20c9c0ca01a76a6a58a0aac7b..9ae47975b155d13d92c67a62451320bfe825cde9 100644 --- a/zh/security-disclosure/2022/2022-05.md +++ b/zh/security-disclosure/2022/2022-05.md @@ -1,33 +1,34 @@ ## 2022年5月安全漏洞 -_发布于2022.5.6_ +_发布于2022.5.6_
+_最后更新于2022.7.15_ | 漏洞编号 | 相关漏洞 | 漏洞描述 | 漏洞影响 | 受影响的版本 | 受影响的仓库 | 修复链接 | 参考链接 | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2022-0501 | NA | 软总线子系统存在堆溢出漏洞。| 攻击者可在本地发起攻击，造成内存访问越界，可获取系统控制权。|OpenHarmony-3.0-LTS|communication_dsoftbus| [链接](https://gitee.com/openharmony/communication_dsoftbus/pulls/1198) |本项目组上报| -|OpenHarmony-SA-2022-0502 | NA | 软总线子系统在接收TCP消息时存在堆溢出漏洞。| 攻击者可在局域网内发起攻击，进行远程代码执行，获得系统控制权。|OpenHarmony-3.0-LTS|communication_dsoftbus| [链接](https://gitee.com/openharmony/communication_dsoftbus/pulls/1113) |本项目组上报| -|OpenHarmony-SA-2022-0503 | NA | 软总线处理设备同步消息时存在越界访问漏洞。| 攻击者可在局域网内发起攻击，可造成内存访问越界，造成DoS攻击。|OpenHarmony-3.0-LTS|communication_dsoftbus| [链接](https://gitee.com/openharmony/communication_dsoftbus/pulls/1369) |本项目组上报| -|OpenHarmony-SA-2022-0504 | NA | Lock类包含的一个指针成员存在重复释放问题。| 攻击者可在本地发起攻击，可获取系统控制权。|OpenHarmony-3.0-LTS|global_resmgr_standard| [链接](https://gitee.com/openharmony/global_resmgr_standard/pulls/136) |本项目组上报| +|OpenHarmony-SA-2022-0501 | NA | 软总线子系统存在堆溢出漏洞。| 攻击者可在本地发起攻击，造成内存访问越界，可获取系统控制权。| OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |communication_dsoftbus| [3.0.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/1372) |本项目组上报| +|OpenHarmony-SA-2022-0502 | NA | 软总线子系统在接收TCP消息时存在堆溢出漏洞。| 攻击者可在局域网内发起攻击，进行远程代码执行，获得系统控制权。| OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release到OpenHarmony-v3.1.1-Release |communication_dsoftbus| [3.0.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/1369)
[3.1.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/1807) |本项目组上报| +|OpenHarmony-SA-2022-0503 | NA | 软总线处理设备同步消息时存在越界访问漏洞。| 攻击者可在局域网内发起攻击，可造成内存访问越界，造成DoS攻击。| OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |communication_dsoftbus| [3.0.x](https://gitee.com/openharmony/communication_dsoftbus/pulls/1422) |本项目组上报| +|OpenHarmony-SA-2022-0504 | NA | Lock类包含的一个指针成员存在重复释放问题。| 攻击者可在本地发起攻击，可获取系统控制权。| OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |global_resource_management| [3.0.x](https://gitee.com/openharmony/global_resource_management/pulls/136) |本项目组上报| ### 以下为三方库漏洞，只提供CVE、严重程度、受影响的OpenHarmony版本，详细信息请参考三方公告。 | CVE | 严重程度 | 受影响的OpenHarmony版本 | 修复链接 | | --- | -------- | ---------------------- | ------- | -| CVE-2022-0778 | 中 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/third_party_openssl/pulls/34) | -| CVE-2018-25032 | 高 | OpenHarmony-1.0-LTS
OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/third_party_zlib/pulls/31)
[链接](https://gitee.com/openharmony/third_party_zlib/pulls/30) | -| CVE-2021-28714 | 中 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/06639c05f98d596690a93b4179235f709fbdfffe) | -| CVE-2021-28715 | 中 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/2938e8ac18d248567afe744760db99c77aff2253) | -| CVE-2022-23222 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/4e695c44106d3f0f9908ffb1c9593205bb7f80ed) | -| CVE-2022-0185 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/76a954013f985828558dc67851b1a455ae7d3421) | -| CVE-2021-22600 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/214329f8032e15f72d39ab3ecf95b5fab274fe1a) | -| CVE-2022-22942 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/9a967f71164cf3b3fc7874b5f1cc193b3819b402) | -| CVE-2022-0492 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/ea8f5c0c115c8c61a76b3dfa51cddb9c5c40fec4) | -| CVE-2022-24448 | 低 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/9e4a6ed92bb4e0b964c5e3fff63d20cf46eda38f)
[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/af9e3d1a2dc61aa346e33a287fb83c8c0d487881)
[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/51fef9de52b5b1431cac919c052f1e82f4cdfbae) | -| CVE-2022-0516 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/8ba71b83e7acfbbf351d3d5b10ced7a4f66c05c9) | -| CVE-2022-0617 | 中 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/999c29733c45ac8864c64aa8b4b98df436327096)
[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/7d65b9dbe4277bac42eb649935cd02fdcd47cfe0) | -| CVE-2022-0847 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/b4e786c8ebae053b21583494b44f97e30b58ec3d) | -| CVE-2022-26490 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/141) | -| CVE-2022-25636 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/62e6212596777900936105d7dbc18ed2303026c0) | -| CVE-2022-26966 | 中 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/4b80b2d8eba4d9df430b5b19096299b017541e1d) | -| CVE-2022-1011 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/013bad7096d7bee6a3beb0936060e07644fc251d) | -| CVE-2022-27223 | 高 | OpenHarmony-3.0-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/commit/5939446d63ddecefdbe31834c2ee00c5bc0514e2) | +| CVE-2022-0778 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/third_party_openssl/pulls/34) | +| CVE-2018-25032 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v1.1.0到OpenHarmony-v1.1.4-LTS |[3.0.x](https://gitee.com/openharmony/third_party_zlib/pulls/30)
[1.1.x](https://gitee.com/openharmony/third_party_zlib/pulls/31) | +| CVE-2021-28714 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/06639c05f98d596690a93b4179235f709fbdfffe) | +| CVE-2021-28715 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/2938e8ac18d248567afe744760db99c77aff2253) | +| CVE-2022-23222 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/4e695c44106d3f0f9908ffb1c9593205bb7f80ed) | +| CVE-2022-0185 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/76a954013f985828558dc67851b1a455ae7d3421) | +| CVE-2021-22600 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/214329f8032e15f72d39ab3ecf95b5fab274fe1a) | +| CVE-2022-22942 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/9a967f71164cf3b3fc7874b5f1cc193b3819b402) | +| CVE-2022-0492 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/ea8f5c0c115c8c61a76b3dfa51cddb9c5c40fec4) | +| CVE-2022-24448 | 低 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/9e4a6ed92bb4e0b964c5e3fff63d20cf46eda38f)
[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/af9e3d1a2dc61aa346e33a287fb83c8c0d487881)
[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/51fef9de52b5b1431cac919c052f1e82f4cdfbae) | +| CVE-2022-0516 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/8ba71b83e7acfbbf351d3d5b10ced7a4f66c05c9) | +| CVE-2022-0617 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/999c29733c45ac8864c64aa8b4b98df436327096)
[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/7d65b9dbe4277bac42eb649935cd02fdcd47cfe0) | +| CVE-2022-0847 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/b4e786c8ebae053b21583494b44f97e30b58ec3d) | +| CVE-2022-26490 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/141) | +| CVE-2022-25636 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/62e6212596777900936105d7dbc18ed2303026c0) | +| CVE-2022-26966 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/4b80b2d8eba4d9df430b5b19096299b017541e1d) | +| CVE-2022-1011 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/013bad7096d7bee6a3beb0936060e07644fc251d) | +| CVE-2022-27223 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/commit/5939446d63ddecefdbe31834c2ee00c5bc0514e2) | diff --git a/zh/security-disclosure/2022/2022-06.md b/zh/security-disclosure/2022/2022-06.md index 682088f7d060252e031d3dae599edc9d4f2b6d26..1e7ca10a8262e7709eef3d9820c7fd81c1e77f99 100644 --- a/zh/security-disclosure/2022/2022-06.md +++ b/zh/security-disclosure/2022/2022-06.md @@ -1,58 +1,58 @@ ## 2022年6月安全漏洞 -_发布于2022.6.6_ +_发布于2022.6.6_
+_最后更新于2022.7.15_ | 漏洞编号 | 相关漏洞 | 漏洞描述 | 漏洞影响 | 受影响的版本 | 受影响的仓库 | 修复链接 | 参考链接 | | -------- |-------- | -------- | -------- | ----------- | ----------- | -------- | ------- | -|OpenHarmony-SA-2022-0601 | NA | 事件通知子系统反序列化对象时会绕过认证机制。 | 攻击者可在本地发起攻击，造成权限绕过，导致服务端进程崩溃。|OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release|notification_ces_standard| [链接](https://gitee.com/openharmony/notification_common_event_service/pulls/269) |本项目组上报| -|OpenHarmony-SA-2022-0602 | NA | 事件通知子系统存在校验绕过漏洞，可发起SA中继攻击。 | 攻击者可在本地发起攻击，造成校验绕过，获得系统控制权。|OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS|notification_ces_standard| [链接](https://gitee.com/openharmony/notification_common_event_service/pulls/245) |本项目组上报| -|OpenHarmony-SA-2022-0603 | NA | 升级服务组件存在校验绕过漏洞，可发起SA中继攻击。 | 攻击者可在本地发起攻击，造成校验绕过，获得系统控制权。 |OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS|update_updateservice| [链接](https://gitee.com/openharmony/update_updateservice/pulls/115) |本项目组上报| -|OpenHarmony-SA-2022-0604 | NA | 多媒体子系统存在校验绕过漏洞，可发起SA中继攻击。 | 攻击者可在本地发起攻击，造成校验绕过，获取系统控制权。|OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS|multimedia_media_standard| [链接](https://gitee.com/openharmony/multimedia_media_standard/pulls/567) |本项目组上报| +|OpenHarmony-SA-2022-0601 | NA | 事件通知子系统反序列化对象时会绕过认证机制。 | 攻击者可在本地发起攻击，造成权限绕过，导致服务端进程崩溃。|OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release|notification_common_event_service| [3.0.x](https://gitee.com/openharmony/notification_common_event_service/pulls/269)
[3.1.x](https://gitee.com/openharmony/notification_common_event_service/pulls/288) |本项目组上报| +|OpenHarmony-SA-2022-0602 | NA | 事件通知子系统存在校验绕过漏洞，可发起SA中继攻击。 | 攻击者可在本地发起攻击，造成校验绕过，获得系统控制权。|OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS|notification_common_event_service| [3.0.x](https://gitee.com/openharmony/notification_common_event_service/pulls/245) |本项目组上报| +|OpenHarmony-SA-2022-0603 | NA | 升级服务组件存在校验绕过漏洞，可发起SA中继攻击。 | 攻击者可在本地发起攻击，造成校验绕过，获得系统控制权。 |OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS|update_updateservice| [3.0.x](https://gitee.com/openharmony/update_updateservice/pulls/115) |本项目组上报| +|OpenHarmony-SA-2022-0604 | NA | 多媒体子系统存在校验绕过漏洞，可发起SA中继攻击。 | 攻击者可在本地发起攻击，造成校验绕过，获取系统控制权。|OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS|multimedia_media_standard| [3.0.x](https://gitee.com/openharmony/multimedia_media_standard/pulls/567) |本项目组上报| ### 以下为三方库漏洞，只提供CVE、严重程度、受影响的OpenHarmony版本，详细信息请参考三方公告。 | CVE | 严重程度 | 受影响的OpenHarmony版本 | 修复链接 | | --- | -------- | ---------------------- | ------- | -| CVE-2022-25313 | 中 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[链接](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-25314 | 高 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[链接](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-25315 | 中 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[链接](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-25235 | 高 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[链接](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-25236 | 严重 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[链接](https://gitee.com/openharmony/third_party_expat/pulls/10) | -| CVE-2022-23308 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.2-LTS |[链接](https://gitee.com/openharmony/third_party_libxml2/pulls/11) | -| CVE-2022-25375 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2022-25258 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2022-0435 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2022-24959 | 低 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2021-44879 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2022-24958 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2021-45402 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | -| CVE-2021-4160 | 中 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[链接](https://gitee.com/openharmony/third_party_openssl/pulls/29) | -| CVE-2022-0778 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/third_party_openssl/pulls/34) | -| CVE-2022-0886 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/143) | -| CVE-2022-1055 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-0995 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2021-39698 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-0494 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-1048 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-1016 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2021-39686 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175) | -| CVE-2022-0500 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/163) | -| CVE-2022-28390 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-28389 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-28388 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-28893 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-1353 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-29156 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-29156 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2022-28356 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181) | -| CVE-2019-16089 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/152) | -| CVE-2021-4156 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/third_party_libsnd/pulls/10) | -| CVE-2022-22576 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/third_party_curl/pulls/52) | -| CVE-2022-27775 | 低 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/third_party_curl/pulls/52) | -| CVE-2022-27776 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/third_party_curl/pulls/52) | -| CVE-2022-27774 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS和OpenHarmony-v3.1-Release |[链接](https://gitee.com/openharmony/third_party_curl/pulls/52) | -| CVE-2021-3520 | 严重 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.2-LTS |[链接](https://gitee.com/openharmony/third_party_lz4/pulls/2) | -| CVE-2021-44732 | 严重 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[链接](https://gitee.com/openharmony/third_party_mbedtls/pulls/31) | -| CVE-2021-36690 | 高 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[链接](https://gitee.com/openharmony/third_party_sqlite/pulls/4) | -| CVE-2021-3732 | 低 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[链接](https://gitee.com/openharmony/kernel_linux_5.10/pulls/180) | -| CVE-2021-22570 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.2-LTS |[链接](https://gitee.com/openharmony/third_party_protobuf/pulls/26) | -| CVE-2021-22569 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.2-LTS |[链接](https://gitee.com/openharmony/third_party_protobuf/pulls/27) | +| CVE-2022-25313 | 中 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-25314 | 高 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-25315 | 中 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-25235 | 高 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-25236 | 严重 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_expat/pulls/10) | +| CVE-2022-23308 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.2-LTS |[3.0.x](https://gitee.com/openharmony/third_party_libxml2/pulls/11) | +| CVE-2022-25375 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2022-25258 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2022-0435 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2022-24959 | 低 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2021-44879 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2022-24958 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2021-45402 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/146) | +| CVE-2021-4160 | 中 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_openssl/pulls/29) | +| CVE-2022-0778 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/third_party_openssl/pulls/34) | +| CVE-2022-0886 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/143) | +| CVE-2022-1055 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-0995 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2021-39698 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-0494 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-1048 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-1016 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2021-39686 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/175)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-0500 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/163) | +| CVE-2022-28390 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-28389 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-28388 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-28893 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-1353 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-29156 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
[3.1.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/214)| +| CVE-2022-28356 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/181)
3.1.x 暂未修复| +| CVE-2019-16089 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/152) | +| CVE-2021-4156 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_libsnd/pulls/10)
[3.1.x](https://gitee.com/openharmony/third_party_libsnd/pulls/11)| +| CVE-2022-22576 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_curl/pulls/52)
[3.1.x](https://gitee.com/openharmony/third_party_curl/pulls/51)| +| CVE-2022-27775 | 低 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_curl/pulls/52)
[3.1.x](https://gitee.com/openharmony/third_party_curl/pulls/51)| +| CVE-2022-27776 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_curl/pulls/52)
[3.1.x](https://gitee.com/openharmony/third_party_curl/pulls/51)| +| CVE-2022-27774 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS
OpenHarmony-v3.1-Release |[3.0.x](https://gitee.com/openharmony/third_party_curl/pulls/52)
[3.1.x](https://gitee.com/openharmony/third_party_curl/pulls/51)| +| CVE-2021-3520 | 严重 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.2-LTS |[3.0.x](https://gitee.com/openharmony/third_party_lz4/pulls/2) | +| CVE-2021-44732 | 严重 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_mbedtls/pulls/31) | +| CVE-2021-36690 | 高 | OpenHarmony-v3.0-LTS和OpenHarmony-v3.0.1-LTS |[3.0.x](https://gitee.com/openharmony/third_party_sqlite/pulls/4) | +| CVE-2021-3732 | 低 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.3-LTS |[3.0.x](https://gitee.com/openharmony/kernel_linux_5.10/pulls/180) | +| CVE-2021-22570 | 高 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.2-LTS |[3.0.x](https://gitee.com/openharmony/third_party_protobuf/pulls/26) | +| CVE-2021-22569 | 中 | OpenHarmony-v3.0-LTS到OpenHarmony-v3.0.2-LTS |[3.0.x](https://gitee.com/openharmony/third_party_protobuf/pulls/27) |