EMUI
These 49 EMUI security issues fixed with July 2021 update
Huawei has just published the latest July 2021 security patch and reveals 49 new EMUI security issues that were fixed with this new security patch.
The fixed EMUI security issues will prevent Common Vulnerabilities and Exposures or CVE from harming user data or blocking any unverified access to the device.
To be mentioned, Huawei’s current days are very hectic because HarmonyOS 2.0 rollout is going on in China and also in preparation for the next flagship global product launch conference, which will be held on July 29. This caused Huawei to polish a late security bulletin.
But, Huawei has made full efforts in finding the EMUI security issues and resolve them with the July 2021 security patch.
July EMUI security patch details:
Huawei has fixes 21 high, and 28 medium levels of CVE as well as 49 hidden EMUI security issues for EMUI and Magic UI devices. Check the solved CVE details, severity, impact, and more detailed below.
Below you can check all of the EMUI security issues mentioned in the July 2021 patch:
CVE 1:
- CVE-2021-22475: Improper permission management vulnerability in some Huawei phones
- Severity: Low
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 2:
- CVE-2021-22394: Buffer overflow vulnerability in some Huawei devices
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, EMUI 10.1.0, Magic UI 4.0.0, Magic UI 3.1.1, Magic UI 3.1.0
- Impact: Successful exploitation of this vulnerability may cause DoS of the apps during Multi-Screen Collaboration.
CVE 3:
- CVE-2021-36997: Low memory error in some Huawei devices due to the unlimited size of images to be parsed
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may cause the Gallery or Files app to exit unexpectedly.
CVE 4:
- CVE-2021-36996: Improper verification vulnerability in some Huawei devices
- Severity: Low
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may cause transmission of certain virtual information.
CVE 5:
- CVE-2021-36995: Unauthorized file access vulnerability in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability by modifying soft links may tamper with the files restored from backups.
CVE 6:
- CVE-2021-36994: Trustlist strings being repeatedly inserted into the linked list in some Huawei devices due to race conditions
- Severity: Low
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability can cause exceptions when managing the system trustlist.
CVE 7:
- CVE-2021-22367: Logic bypass vulnerability in some Huawei devices
- Severity: High
- Affected versions: EMUI 10.1.1, EMUI 10.1.0, EMUI 10.0.0, EMUI 9.1.1, EMUI 9.1.0, Magic UI 3.1.1, Magic UI 3.1.0, Magic UI 3.0.0, Magic UI 2.1.1
- Impact: Successful exploitation of this vulnerability may lead to authentication bypass.
CVE 8:
- CVE-2021-36993: Memory leaks in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may affect service availability.
CVE 9:
- CVE-2021-36992: Public key verification vulnerability in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 10:
- CVE-2021-36991: Unauthorized file access vulnerability in some Huawei devices due to unstandardized path input
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability by creating malicious file paths can cause unauthorized file access.
CVE 11:
- CVE-2021-36990: Vulnerability of tampering with the kernel in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may escalate permissions.
CVE 12:
- CVE-2021-36989: Kernel crash vulnerability in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may escalate permissions.
CVE 13:
- CVE-2021-36988: Parameter verification issues in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability can affect service integrity.
CVE 14:
- CVE-2021-36987: Nodes in the linked list being freed for multiple times in some Huawei devices due to race conditions
- Severity: High
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability can cause the system to restart.
CVE 15:
- CVE-2021-36986: Vulnerability of tampering with the kernel in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may escalate permissions.
CVE 16:
- CVE-2021-36985: Code injection vulnerability in some Huawei devices
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may exhaust system resources and cause the system to restart.
CVE 17:
- CVE-2021-22491: Input verification vulnerability in some Huawei devices
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may affect service availability.
CVE 18:
- CVE-2021-22490: Permission verification vulnerability in some Huawei phones
- Severity: Low
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, EMUI 10.1.0, Magic UI 4.0.0, Magic UI 3.1.1, Magic UI 3.1.0
- Impact: Successful exploitation of this vulnerability may affect the device performance.
CVE 19:
- CVE-2021-22488: Unauthorized file access vulnerability in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability by modifying soft links may tamper with the files restored from backups.
CVE 20:
- CVE-2021-22487: Out-of-bounds read vulnerability in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may affect service availability.
CVE 21:
- CVE-2021-22486: Unstandardized field names in some Huawei phones
- Severity: High
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 22:
- CVE-2021-22485: SSID vulnerability with Wi-Fi network connections in Huawei devices
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 23:
- CVE-2021-22483: IP address spoofing vulnerability in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may cause DoS.
CVE 24:
- CVE-2021-22482: Uninitialized variable vulnerability in some Huawei devices
- Severity: Low
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may cause transmission of invalid data.
CVE 25:
- CVE-2021-36998: Improper verification vulnerability in some devices
- Severity: Low
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may allow attempts to read an array that is out of bounds.
CVE 26:
- CVE-2021-22474: Out-of-bounds memory access in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may cause process exceptions.
CVE 27:
- CVE-2021-22473: Authentication vulnerability in some Huawei devices
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, EMUI 10.1.0, EMUI 10.0.0, EMUI 9.1.1, EMUI 9.1.0, Magic UI 4.0.0, Magic UI 3.1.1, Magic UI 3.1.0, Magic UI 3.0.0, Magic UI 2.1.1
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 28:
- CVE-2021-22472: Improper verification vulnerability in some Huawei phones
- Severity: High
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 29:
- CVE-2021-22460: Boot restriction bypass vulnerability in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 30:
- CVE-2021-22455: Integer overflow vulnerability with the Always On Display (AOD) driver in some Huawei devices
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may escalate the permission to that of the root user.
CVE 31:
- CVE-2021-22450: Memory leaks in some Huawei devices due to exceptions when freeing memory
- Severity: High
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability will exhaust system memory resources and cause the device to restart.
CVE 32:
- CVE-2021-22436: Logic bypass vulnerability in some Huawei devices
- Severity: High
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may affect service integrity and availability.
CVE 33:
- CVE-2021-22435: Logic bypass vulnerability in some Huawei devices
- Severity: High
- Affected versions: EMUI 10.1.1, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may affect service integrity and availability.
CVE 34:
- CVE-2021-22425: Nodes in the linked list being freed for multiple times in some Huawei devices due to race conditions
- Severity: High
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability can cause the system to restart.
CVE 35:
- CVE-2021-22423: Integer overflow vulnerability with the Always On Display (AOD) driver in some Huawei devices
- Severity: High
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may escalate the permission to that of the root user.
CVE 36:
- CVE-2021-22422: Integer overflow vulnerability with the Always On Display (AOD) driver in some Huawei devices
- Severity: High
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may escalate the permission to that of the root user.
CVE 37:
- CVE-2021-22419: Startup verification vulnerability with non-Huawei APKs in some Huawei devices
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may allow knock-off apps to run automatically.
CVE 38:
- CVE-2021-22418: Integer overflow vulnerability with the Always On Display (AOD) driver in some Huawei devices
- Severity: High
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability may escalate the permission to that of the root user.
CVE 39:
- CVE-2021-22417: Memory leaks and out-of-bounds access vulnerabilities in some Huawei phones
- Severity: High
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of these vulnerabilities may escalate the permission to that of the root user.
CVE 40:
- CVE-2021-22407: Identity verification vulnerability due to unverified server when connecting Huawei phones to a computer via HiSuite
- Severity: Low
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 41:
- CVE-2021-22406: Remote DoS vulnerability with the MeeTime app
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, EMUI 10.1.0, EMUI 10.0.0, EMUI 9.1.1, EMUI 9.1.0, Magic UI 4.0.0, Magic UI 3.1.1, Magic UI 3.1.0, Magic UI 3.0.0, Magic UI 2.1.1
- Impact: Successful exploitation of this vulnerability will cause the app to exit unexpectedly.
CVE 42:
- CVE-2021-22405: Configuration defects in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may affect service availability.
CVE 43:
- CVE-2021-22404: Directory traversal vulnerability in Huawei phones
- Severity: Low
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, EMUI 10.1.0, EMUI 10.0.0, EMUI 9.1.1, EMUI 9.1.0, Magic UI 4.0.0, Magic UI 3.1.1, Magic UI 3.1.0, Magic UI 3.0.0, Magic UI 2.1.1
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 44:
- CVE-2021-22403: Vulnerability of hijacking unverified providers in some Huawei phones
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, EMUI 10.1.0, EMUI 10.0.0, EMUI 9.1.1, EMUI 9.1.0, Magic UI 4.0.0, Magic UI 3.1.1, Magic UI 3.1.0, Magic UI 3.0.0, Magic UI 2.1.1
- Impact: Successful exploitation of this vulnerability may allow attackers to hijack the device and forge UIs to induce users to execute malicious commands.
CVE 45:
- CVE-2021-22402: DoS vulnerability in some Huawei phones
- Severity: High
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may cause DoS attacks.
CVE 46:
- CVE-2021-22401: Remote DoS vulnerability in some Huawei phones
- Severity: High
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability can affect service integrity.
CVE 47:
- CVE-2021-22395: Code injection vulnerability in some Huawei devices
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, EMUI 10.1.0, Magic UI 4.0.0, Magic UI 3.1.1, Magic UI 3.1.0
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
CVE 48:
- CVE-2021-36999: Buffer overflow vulnerability in some Huawei devices
- Severity: Medium
- Affected versions: EMUI 11.0.0, EMUI 10.1.1, Magic UI 4.0.0, Magic UI 3.1.1
- Impact: Successful exploitation of this vulnerability by sending malicious images and inducing users to open the images may cause remote code execution.
CVE 49:
- CVE-2021-37000: Improper permission management vulnerability in some Huawei phones
- Severity: High
- Affected versions: EMUI 11.0.0, Magic UI 4.0.0
- Impact: Successful exploitation of this vulnerability may affect service confidentiality.
Huawei P40 lite is one of the most amazing smartphones to buy and the company is now sending a new software update for this device that brings March 2023 security patches.
You should know that such updates roll out in batches and may take some time to reach the smartphone. However, you are free to check this release manually via Settings. If you have more doubts on this matter, please check the instructions mentioned below.
Huawei P40 Lite comes with a 6.4-inch display and it’s powered by Kirin 810 (7 nm) chipset with Octa-core (2×2.27 GHz Cortex-A76 & 6×1.88 GHz Cortex-A55) and Mali-G52 MP6 GPU.
The phone equips a quad camera system including a 48 MP main camera with f/1.8, 26mm (wide), 1/2.0″, 0.8µm, PDAF + an 8 MP (ultrawide) with f/2.4 + a 2 MP macro camera with f/2.4 and a 2 MP f/2.4 aperture depth camera. The phone has a 16 MP front-facing camera with f/2.0, (wide), 1/3.06″.
Looking at the firmware, the March 2023 update for Huawei P40 Lite comes with EMUI 12 version 12.0.0.271. You will have to download an update package size of 424 MB. The changelog only says about the security patches but there’s more on this matter that you should know.
Huawei has also installed a new widget to the Device+ feature, which allows you to manage watch and band devices directly from the control panel.
How to update:
To install the latest software update, head towards Settings > from here and tap on System & updates. Now you need to open the Software updates menu and not tap on CHECK FOR UPDATES at the bottom of the screen.
(source)
EMUI 8 (Android 8) is released a long ago and Huawei published this roadmap to the Mate 8 in 2018. However, there is one Huawei Mate 8 user that now received EMUI 8, which took too long to come.
According to the information, Huawei released the EMUI 8 schedule for all of its devices in 2017. Huawei Mate 8 was also a part of the upgrade process along with other smartphones.
Phone users in the global market already installed this major OTA update. However, there may be a few users that were stuck on the old firmware EMUI 5.0 (based on Android 7).
You should know that Huawei Mate 8 was launched with EMUI 4 version and has better camera features. However, it later received version 5.0, followed by EMUI 8. Now, there’s no major software update available for this device.
EMUI 8:
The Huawei Mate 8 user who sent us this information is surprised by the fact that the phone wasn’t able to fetch the firmware for this long. As the other users had it 4 years ago.
A similar issue has been caught in other Huawei devices and stop receiving new software updates without any reason. There are also some external factors including the use case in another country. This could also delay OTA delivery.
As for the firmware, it comes with version 8.0.0.829 and has a package size of 2.29GB. The changelog reveals that the update packs Android 8 and also boosts performance. To be mentioned, Huawei has added new features and improvements to make this smartphone more useful and intuitive, faster and safer.
Huawei Mate 8 comes with Kirin 950 chipset and 6 inches full HD resolution display. The phone has a 16MP rear camera and an 8MP selfie camera. Looking at the design, the phone has a wide display with top and bottom bezels and there’s a physical fingerprint reader below the rear camera module.
Thanks, Zhao for the amazing tip.
Huawei has released March 2023 EMUI security patch details for global users and updates are flying everywhere among global smartphones. On the other hand, most Huawei phones have already received February 2023 security patch.
Huawei rolls out these software upgrades to improve the user experience. Therefore, it’s recommended that you install the latest firmware to keep your smartphone up to date with the latest security solutions. That’s not it, Huawei could also send some system patches for performance improvement, which you can check manually via Settings.
EMUI 13
Meanwhile, users are eagerly waiting for a new major upgrade – EMUI 13. Interestingly, March also going silent, as we move half-way-through this month. It’s been a year since EMUI 12 made its debut and still, users now asking for Huawei’s take on EMUI 13 release for old devices.
P60 series:
Other than this, Huawei is also preparing to launch the Huawei P60 series, which will bring a number of new technologies. Furthermore, it could come with various new features, which may later be added to EMUI software. Yet, none of these are confirmed officially.
But we’ll keep you posted with all of the latest development in this story.
Until then, check all the Huawei EMUI software updates rolling out in March 2023.
March 25, 2023:
- Huawei Nova Y70 receives 12.0.0.212 software with March 2023 security patch for better system security.
- Huawei Nova 9 gets EMUI 12.0.1.276 with a number of new optimizations including display, apps, system, and stability.
March 21, 2023:
- Huawei P40 Lite users in Europe are getting firmware version 12.0.0.268 with the latest security patch solutions.
- The latest feature-packed Huawei Mate 50 Pro software update for global users is reaching more places, allowing them to experience the latest additions on the go.
March 20, 2023:
- Huawei is sending a new software update for the Huawei P50 Pro smartphone in the global market that comes with March 2023 security update and firmware version 12.0.1.292.
March 18, 2023:
Huawei Mate 50 Pro in the global market is getting a new software update that comes with EMUI version 13.0.0.204 and a package size of 867 megabytes. However, the changelog of this update is more interesting because there are a lot of changes inside.
According to the information, Huawei is sending new camera improvements for better photography, it also has apps and sound quality optimizations. Furthermore, you will latest solutions for better system performance and security. Read more here.
March 10, 2023:
- Huawei Mate 40 Pro is one of the first smartphones to get the March 2023 security update, it’s EMUI firmware version is 12.0.0.307.
March 9, 2023:
- Huawei Nova 8i, Nova Y61, and Nova Y60 are grabbing February 2023 security update with EMUI version 11.0.1.237, 12.0.0.13, and 11.0.1.94 for Nova 8i, Y61, and Y60 respectively.
March 7, 2023:
- Huawei Nova 7 is receiving a new firmware update that comes with build version 12.0.0.251, which improves the phone’s security by featuring EMUI February 2023 patch.
March 6, 2023:
- Huawei Mate 40 Pro is getting a new software update in the global market that comes with February 2023 security patch and it has EMUI version 12.0.0.302.
March 4, 2023:
- Huawei FreeBuds 5i is up to grab a new system stability firmware upgrade that improves these earbuds’ performance.
- Huawei P40 Lite can now download February 2023 security patch via OTA and the version is 12.0.0.268.
March 3, 2023:
- Huawei Nova 10 series is one of the earliest phones to launch with pre-installed EMUI 12 and now the Chinese tech maker is sending February 2023 security update for this smartphone in the global market.
March 2, 2023:
- Huawei has released a new software update for the P30 Pro flagship with version 12.0.0.149 and it comes with February 2023 security patch for improved system safety. While, users of this phone want to fix the blur issue that is occurring on the main camera of the flagship.
