Details of VAR-202201-1024

ID

VAR-202201-1024

CVE

CVE-2021-40031

TITLE

EMUI and Magic UI In NULL Pointer dereference vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2022-002896

DESCRIPTION

There is a Null pointer dereference vulnerability in the camera module in smartphones. Successful exploitation of this vulnerability may affect service integrity. Huawei HarmonyOS is an operating system of the Chinese company Huawei. Provide a microkernel-based full-scenario distributed operating system. The Huawei HarmonyOS Camera component has a buffer error vulnerability

Trust: 1.71

sources: NVD: CVE-2021-40031 // JVNDB: JVNDB-2022-002896 // VULHUB: VHN-401432

AFFECTED PRODUCTS

vendor:	huawei	model:	emui	scope:	eq	version:	11.0.0	Trust: 1.0
vendor:	huawei	model:	magic ui	scope:	eq	version:	4.0.0	Trust: 1.0
vendor:	huawei	model:	emui	scope:	eq	version:	12.0.0	Trust: 1.0
vendor:	huawei	model:	emui	scope:	-	version:	-	Trust: 0.8
vendor:	huawei	model:	magic ui	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-002896 // NVD: CVE-2021-40031

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2021-40031
value:	HIGH
Trust: 1.0
NVD:	CVE-2021-40031
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202201-297
value:	HIGH
Trust: 0.6
VULHUB:	VHN-401432
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2021-40031
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-401432
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2021-40031
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2021-40031
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-401432 // JVNDB: JVNDB-2022-002896 // CNNVD: CNNVD-202201-297 // NVD: CVE-2021-40031

PROBLEMTYPE DATA

problemtype:	CWE-476	Trust: 1.1
problemtype:	NULL Pointer dereference (CWE-476) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-401432 // JVNDB: JVNDB-2022-002896 // NVD: CVE-2021-40031

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202201-297

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202201-297

PATCH

title:	HUAWEI EMUI/Magic UI security updates January 2022	url:	https://consumer.huawei.com/en/support/bulletin/2022/1/	Trust: 0.8
title:	Huawei HarmonyOS Fixes for code issue vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=178003	Trust: 0.6

sources: JVNDB: JVNDB-2022-002896 // CNNVD: CNNVD-202201-297

EXTERNAL IDS

db:	NVD	id:	CVE-2021-40031	Trust: 3.3
db:	JVNDB	id:	JVNDB-2022-002896	Trust: 0.8
db:	CNNVD	id:	CNNVD-202201-297	Trust: 0.7
db:	VULHUB	id:	VHN-401432	Trust: 0.1

sources: VULHUB: VHN-401432 // JVNDB: JVNDB-2022-002896 // CNNVD: CNNVD-202201-297 // NVD: CVE-2021-40031

REFERENCES

url:	https://consumer.huawei.com/en/support/bulletin/2022/1/	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2021-40031	Trust: 1.4
url:	https://device.harmonyos.com/cn/docs/security/update/security-bulletins-202201-0000001238736331	Trust: 0.6

sources: VULHUB: VHN-401432 // JVNDB: JVNDB-2022-002896 // CNNVD: CNNVD-202201-297 // NVD: CVE-2021-40031

SOURCES

db:	VULHUB	id:	VHN-401432
db:	JVNDB	id:	JVNDB-2022-002896
db:	CNNVD	id:	CNNVD-202201-297
db:	NVD	id:	CVE-2021-40031

LAST UPDATE DATE

2024-08-14T14:37:42.415000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-401432	date:	2022-01-13T00:00:00
db:	JVNDB	id:	JVNDB-2022-002896	date:	2023-01-25T07:51:00
db:	CNNVD	id:	CNNVD-202201-297	date:	2022-01-17T00:00:00
db:	NVD	id:	CVE-2021-40031	date:	2022-01-13T14:37:17.600

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-401432	date:	2022-01-10T00:00:00
db:	JVNDB	id:	JVNDB-2022-002896	date:	2023-01-25T00:00:00
db:	CNNVD	id:	CNNVD-202201-297	date:	2022-01-05T00:00:00
db:	NVD	id:	CVE-2021-40031	date:	2022-01-10T14:10:21.987