CVE-2021-37045
📋 TL;DR
This CVE describes a use-after-free vulnerability in Huawei smartphones that allows attackers to execute arbitrary kernel-mode code. Successful exploitation can cause device crashes or complete system compromise. Affects Huawei devices running HarmonyOS or EMUI.
💻 Affected Systems
- Huawei smartphones
📦 What is this software?
Emui by Huawei
Harmonyos by Huawei
Magic Ui by Huawei
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise with kernel-level code execution, allowing persistent malware installation, data theft, and complete control over the device.
Likely Case
Device instability leading to unexpected reboots, potential denial of service, and possible privilege escalation to kernel mode.
If Mitigated
Limited impact with proper patching, though device may still experience instability if exploited before patching.
🎯 Exploit Status
Requires local access or ability to execute code on device; kernel exploitation requires specific knowledge of Huawei's kernel implementation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: HarmonyOS 2.0.0.230 and later, EMUI with September 2021 security patches
Vendor Advisory: https://consumer.huawei.com/en/support/bulletin/2021/9/
Restart Required: Yes
Instructions:
1. Check for system updates in device settings. 2. Install available security updates. 3. Reboot device after installation completes.
🧯 If You Can't Patch
- Restrict physical access to devices
- Implement strict application installation policies to prevent malicious apps
🔍 How to Verify
Check if Vulnerable:
Check device settings > About phone > HarmonyOS/EMUI version. If version is earlier than HarmonyOS 2.0.0.230 or lacks September 2021 security patches, device is vulnerable.Check Version:
Settings > About phone > HarmonyOS version or EMUI versionVerify Fix Applied:
Verify HarmonyOS version is 2.0.0.230 or later, or EMUI has September 2021 security patches installed.📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- Kernel panic logs
- Suspicious kernel module loading
Network Indicators:
- Unusual outbound connections from device
- Suspicious network activity from kernel processes
SIEM Query:
device_logs:kernel_panic OR device_logs:unexpected_reboot AND device_vendor:Huawei🔗 References
- https://consumer.huawei.com/en/support/bulletin/2021/9/
- https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-0000001196270727
- https://consumer.huawei.com/en/support/bulletin/2021/9/
- https://device.harmonyos.com/en/docs/security/update/security-bulletins-202109-0000001196270727
