CVE-2021-22294 Privilege escalation in HarmonyOS

Low 3.3 Published 2 Mar 2021 Updated 3 Aug 2024

Local attackers can bypass permissions to exhaust system resources, requiring OS updates to mitigate.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-22294?

CVE-2021-22294 is a low-severity vulnerability in Huawei Harmonyos, published on 2 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A component API of the HarmonyOS 2.0 has a permission bypass vulnerability. Local attackers may exploit this vulnerability to issue commands repeatedly, exhausting system service resources.

Which versions are affected by CVE-2021-22294?

It affects 1 product.

Products include Huawei Harmonyos.

How do I fix CVE-2021-22294?

No fix has been published for CVE-2021-22294 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-22294 being exploited?

There is no known exploitation of CVE-2021-22294 in the wild and no public exploit code.

All Huawei Harmonyos vulnerabilities

Sources

Also known as GHSA-hp88-gg5p-j7jj.