CVE-2022-43495 An abnormal packet recieved when distributedhardware_device_manager joining a network could cause a device reboot.

What is CVE-2022-43495?

CVE-2022-43495 is a medium-severity vulnerability in OpenHarmony, published on 3 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a network. Network attakcers can send an abonormal packet when joining a network, cause a nullptr reference and device reboot.

Weakness: CWE-476

Which versions are affected by CVE-2022-43495?

It affects 1 product.

Products include Openharmony Openharmony.

How do I fix CVE-2022-43495?

No fix has been published for CVE-2022-43495 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-43495 being exploited?

There is no known exploitation of CVE-2022-43495 in the wild and no public exploit code.

Other vulnerabilities in OpenHarmony

• CVE-2022-38700 Auth bypass in OpenHarmony High 8.8
• CVE-2022-43451 Multiple path traversal in appspawn and nwebspawn services. High 8.4
• CVE-2022-42488 Missing authorization in OpenHarmony High 8.4
• CVE-2022-45877 Weak cryptography in OpenHarmony High 8.3
• CVE-2022-42463 Auth bypass in OpenHarmony High 8.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mgr9-pm96-3xmm.