CVE-2022-41578 - Vulnerability Details - OpenCVE

Description

The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation attacks implemented by modifying program information.

Published: 2022-10-14

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

No analysis available yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Huawei

HarmonyOS

affected

Version	Status	Constraints
`2.0`	affected	—
`2.1`	affected	—

Huawei

EMUI

affected

Version	Status	Constraints
`12.0.0`	affected	—
`11.0.1`	affected	—

Configuration 1 [-]

OR	cpe:2.3:o:huawei:emui:11.0.1:::::::*
	cpe:2.3:o:huawei:emui:12.0.0:::::::*
	cpe:2.3:o:huawei:harmonyos:2.0:::::::*
	cpe:2.3:o:huawei:harmonyos:2.1:::::::*

No data.

No data available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2022-44770	The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation attacks implemented by modifying program information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00247.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://consumer.huawei.com/en/support/bulletin/2022/10/
https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697

History

Wed, 14 May 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Subscriptions

Huawei Emui Harmonyos

MITRE

Status: PUBLISHED

Assigner: huawei

Published: 2022-10-14T00:00:00.000Z

Updated: 2025-05-14T20:30:13.407Z

Reserved: 2022-09-27T00:00:00.000Z

Link: CVE-2022-41578

Vulnrichment

Updated: 2024-08-03T12:49:42.978Z

NVD

Status : Modified

Published: 2022-10-14T16:15:21.030

Modified: 2025-05-14T21:15:55.750

Link: CVE-2022-41578

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-787

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-41578", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "assignerShortName": "huawei", "dateUpdated": "2025-05-14T20:30:13.407Z", "dateReserved": "2022-09-27T00:00:00.000Z", "datePublished": "2022-10-14T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2022-10-14T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation attacks implemented by modifying program information."}], "affected": [{"vendor": "Huawei", "product": "HarmonyOS", "versions": [{"version": "2.0", "status": "affected"}, {"version": "2.1", "status": "affected"}]}, {"vendor": "Huawei", "product": "EMUI", "versions": [{"version": "12.0.0", "status": "affected"}, {"version": "11.0.1", "status": "affected"}]}], "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2022/10/"}, {"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "Out-of-bounds write vulnerability"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:49:42.978Z"}, "title": "CVE Program Container", "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2022/10/", "tags": ["x_transferred"]}, {"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697", "tags": ["x_transferred"]}]}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-14T20:29:57.222557Z", "id": "CVE-2022-41578", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-14T20:30:13.407Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2022/10/", "tags": ["x_transferred"]}, {"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T12:49:42.978Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-41578", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-05-14T20:29:57.222557Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-14T20:30:10.114Z"}}], "cna": {"affected": [{"vendor": "Huawei", "product": "HarmonyOS", "versions": [{"status": "affected", "version": "2.0"}, {"status": "affected", "version": "2.1"}]}, {"vendor": "Huawei", "product": "EMUI", "versions": [{"status": "affected", "version": "12.0.0"}, {"status": "affected", "version": "11.0.1"}]}], "references": [{"url": "https://consumer.huawei.com/en/support/bulletin/2022/10/"}, {"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697"}], "descriptions": [{"lang": "en", "value": "The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation attacks implemented by modifying program information."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Out-of-bounds write vulnerability"}]}], "providerMetadata": {"orgId": "25ac1063-e409-4190-8079-24548c77ea2e", "shortName": "huawei", "dateUpdated": "2022-10-14T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-41578", "state": "PUBLISHED", "dateUpdated": "2025-05-14T20:30:13.407Z", "dateReserved": "2022-09-27T00:00:00.000Z", "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e", "datePublished": "2022-10-14T00:00:00.000Z", "assignerShortName": "huawei"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:huawei:emui:11.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "511F8CE2-C2B6-4A08-B992-49D9B75B8655", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:emui:12.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "A974CA73-84E8-480B-BB4C-4A81D0C985B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "3AD62E8B-CB4B-43A6-98E8-09A8A1A3505B", "vulnerable": true}, {"criteria": "cpe:2.3:o:huawei:harmonyos:2.1:*:*:*:*:*:*:*", "matchCriteriaId": "BCE0AFB0-A112-484B-BEAD-A7F1BDDCE313", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MPTCP module has an out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause root privilege escalation attacks implemented by modifying program information."}, {"lang": "es", "value": "El m\u00f3dulo MPTCP presenta una vulnerabilidad de escritura fuera de l\u00edmites. Una explotaci\u00f3n con \u00e9xito de esta vulnerabilidad puede causar ataques de escalada de privilegios root implementados mediante la modificaci\u00f3n de la informaci\u00f3n del programa"}], "id": "CVE-2022-41578", "lastModified": "2025-05-14T21:15:55.750", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-10-14T16:15:21.030", "references": [{"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletin/2022/10/"}, {"source": "psirt@huawei.com", "tags": ["Vendor Advisory"], "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://consumer.huawei.com/en/support/bulletin/2022/10/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-phones-202210-0000001416095697"}], "sourceIdentifier": "psirt@huawei.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-787"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}