Details of VAR-202112-0225

ID

VAR-202112-0225

CVE

CVE-2021-37095

TITLE

Huawei Integer overflow vulnerability in smartphones

Trust: 0.8

sources: JVNDB: JVNDB-2021-015940

DESCRIPTION

There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to remote denial of service and potential remote code execution. Huawei Smartphones contain an integer overflow vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Huawei HarmonyOS is an operating system of the Chinese company Huawei. Provide a microkernel-based full-scenario distributed operating system. There is a security vulnerability in Huawei HarmonyOS, which is caused by a component of the product that fails to effectively verify integer data

Trust: 1.71

sources: NVD: CVE-2021-37095 // JVNDB: JVNDB-2021-015940 // VULHUB: VHN-398931

AFFECTED PRODUCTS

vendor:	huawei	model:	harmonyos	scope:	lt	version:	2.0	Trust: 1.0
vendor:	huawei	model:	harmonyos	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	harmonyos	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2021-015940 // NVD: CVE-2021-37095

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-37095
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2021-37095
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-202109-2026
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-398931
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2021-37095
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-398931
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-37095
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2021-37095
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-398931 // JVNDB: JVNDB-2021-015940 // CNNVD: CNNVD-202109-2026 // NVD: CVE-2021-37095

PROBLEMTYPE DATA

problemtype:	CWE-190	Trust: 1.1
problemtype:	Integer overflow or wraparound (CWE-190) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-398931 // JVNDB: JVNDB-2021-015940 // NVD: CVE-2021-37095

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202109-2026

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202109-2026

PATCH

title:	security-bulletins-202109-0000001196270727	url:	https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-0000001196270727	Trust: 0.8
title:	Huawei HarmonyOS Enter the fix for the verification error vulnerability	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=173503	Trust: 0.6

sources: JVNDB: JVNDB-2021-015940 // CNNVD: CNNVD-202109-2026

EXTERNAL IDS

db:	NVD	id:	CVE-2021-37095	Trust: 3.3
db:	JVNDB	id:	JVNDB-2021-015940	Trust: 0.8
db:	CNNVD	id:	CNNVD-202109-2026	Trust: 0.6
db:	CNVD	id:	CNVD-2021-103536	Trust: 0.1
db:	VULHUB	id:	VHN-398931	Trust: 0.1

sources: VULHUB: VHN-398931 // JVNDB: JVNDB-2021-015940 // CNNVD: CNNVD-202109-2026 // NVD: CVE-2021-37095

REFERENCES

url:	https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-0000001196270727	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-37095	Trust: 1.4
url:	https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202109-0000001196270727	Trust: 0.6

sources: VULHUB: VHN-398931 // JVNDB: JVNDB-2021-015940 // CNNVD: CNNVD-202109-2026 // NVD: CVE-2021-37095

SOURCES

db:	VULHUB	id:	VHN-398931
db:	JVNDB	id:	JVNDB-2021-015940
db:	CNNVD	id:	CNNVD-202109-2026
db:	NVD	id:	CVE-2021-37095

LAST UPDATE DATE

2024-08-14T15:16:58.938000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-398931	date:	2021-12-09T00:00:00
db:	JVNDB	id:	JVNDB-2021-015940	date:	2022-12-05T01:21:00
db:	CNNVD	id:	CNNVD-202109-2026	date:	2021-12-10T00:00:00
db:	NVD	id:	CVE-2021-37095	date:	2021-12-09T17:34:29.353

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-398931	date:	2021-12-07T00:00:00
db:	JVNDB	id:	JVNDB-2021-015940	date:	2022-12-05T00:00:00
db:	CNNVD	id:	CNNVD-202109-2026	date:	2021-09-05T00:00:00
db:	NVD	id:	CVE-2021-37095	date:	2021-12-07T17:15:09.857