CVE-2022-45118 : Security Advisory and Response

OpenHarmony-v3.1.2 and prior versions had a vulnerability where telephony in the communication subsystem sends public events with personal data without proper permission. This could allow malicious apps to access sensitive information such as mobile numbers and SMS data.

Understanding CVE-2022-45118

This CVE highlights a security issue in OpenHarmony versions prior to 3.1.2, presenting a risk of unauthorized access to personal data through the communication subsystem.

What is CVE-2022-45118?

CVE-2022-45118 affects OpenHarmony versions before 3.1.2, enabling malicious applications to intercept public events and extract sensitive personal data like mobile numbers and SMS content without proper permissions.

The Impact of CVE-2022-45118

The vulnerability, categorized as CAPEC-131 Resource Leak Exposure, poses a medium severity threat with a CVSS base score of 6.2. It has a high impact on confidentiality, potentially exposing user-sensitive information to unauthorized entities.

Technical Details of CVE-2022-45118

The vulnerability in the communication subsystem of OpenHarmony allows unauthorized access to public events containing personal data, circumventing the necessary permissions.

Vulnerability Description

OpenHarmony versions prior to 3.1.2 fail to enforce proper permission settings, enabling malicious apps to eavesdrop on public events and gather personal information such as mobile numbers and SMS data.

Affected Systems and Versions

OpenHarmony versions up to 3.1.0 are affected by this security flaw, making them susceptible to data leakage and privacy breaches.

Exploitation Mechanism

Malicious apps can exploit this vulnerability by intercepting public events transmitted by the communication subsystem, leading to the unauthorized extraction of sensitive personal data.

Mitigation and Prevention

To address CVE-2022-45118, immediate action and long-term security practices are crucial.

Immediate Steps to Take

Users and organizations should promptly update their OpenHarmony installations to version 3.1.2 or above to mitigate the risk of data exposure and ensure the protection of personal information.

Long-Term Security Practices

Implement robust security measures, such as regular security assessments, access controls, and user permission reviews, to prevent similar vulnerabilities and enhance overall system security.

Patching and Updates

Stay informed about security patches and updates released by OpenHarmony to address known vulnerabilities and strengthen the security posture of the system.