OpenHarmony 4.0.4 Release

Version Description

OpenHarmony 4.0.4 Release provides enhanced system security over OpenHarmony 4.0.3 Release by rectifying certain known vulnerabilities in open-source components such as Linux kernel, and system stability issues.

Version Mapping

Table 1 Version mapping of software and tools

Software/Tool	Version	Remarks
OpenHarmony	4.0.4 Release	NA
Public SDK	Ohos_sdk_public 4.0.13.5 (API Version 10 Release)	This toolkit is intended for application developers and does not contain system APIs that require system permissions. It is provided as standard in DevEco Studio.
(Optional) HUAWEI DevEco Studio	4.0 Release	Recommended for developing OpenHarmony applications How to obtain: SHA-256 checksum: 2c88cf43e1ef6ba722aac31eccc8ef92f07a9b72e43a9c1df127017828a22137 SHA-256 checksum: 25e491458eec50b4abddf5bed6aa85893801d70afbce02958f17bd904619405a SHA-256 checksum: 284cb01f7b819e0da1d4fcacbbbbe8017ba220b5e3b9b1d5e4cc59ea30456acc
(Optional) HUAWEI DevEco Device Tool	4.0 Release	Recommended for developing OpenHarmony smart devices Click here.

Source Code Acquisition

Prerequisites

Install the git client and git-lfs, and configure user information.

git config --global user.name "yourname"
git config --global user.email "your-email-address"
git config --global credential.helper store

Run the following commands to install the repo tool:

curl -s https://gitee.com/oschina/repo/raw/fork_flow/repo-py3 > /usr/local/bin/repo  # If you do not have the permission, download the tool to another directory and configure it as an environment variable by running the chmod a+x /usr/local/bin/repo command.
pip3 install -i https://repo.huaweicloud.com/repository/pypi/simple requests

Acquiring Source Code Using the repo Tool

Method 1 (recommended)

Use the repo tool to download the source code over SSH. (You must have an SSH public key for access to Gitee.)

Obtain the source code from the version branch. You can obtain the latest source code of the version branch, which includes the code that has been incorporated into the branch up until the time you run the following commands:
```
repo init -u git@gitee.com:openharmony/manifest.git -b OpenHarmony-4.0.4-Release --no-repo-verify
repo sync -c
repo forall -c 'git lfs pull'
```

Obtain the source code from the version tag, which is the same as that released with the version.

repo init -u git@gitee.com:openharmony/manifest.git -b refs/tags/OpenHarmony-v4.0.4-Release --no-repo-verify
repo sync -c
repo forall -c 'git lfs pull'

Method 2

Use the repo tool to download the source code over HTTPS.

Obtain the source code from the version branch. You can obtain the latest source code of the version branch, which includes the code that has been incorporated into the branch up until the time you run the following commands:
```
repo init -u https://gitee.com/openharmony/manifest -b OpenHarmony-4.0.4-Release --no-repo-verify
repo sync -c
repo forall -c 'git lfs pull'
```

Obtain the source code from the version tag, which is the same as that released with the version.

repo init -u https://gitee.com/openharmony/manifest -b refs/tags/OpenHarmony-v4.0.4-Release --no-repo-verify
repo sync -c
repo forall -c 'git lfs pull'

Acquiring Source Code from Mirrors

Table 2 Mirrors for acquiring source code

Source Code	Version	Mirror	SHA-256 Checksum	Software Package Size
Full code base (for mini, small, and standard systems)	4.0.4Release	Download	Download	32.7 GB
Hi3861 solution (binary)	4.0.4Release	Download	Download	25.2 MB
Hi3516 solution-LiteOS (binary)	4.0.4Release	Download	Download	304.1 MB
Hi3516 solution-Linux (binary)	4.0.4Release	Download	Download	195.9 MB
RK3568 standard system solution (binary)	4.0.4Release	Download	Download	5.2 GB
Public SDK package for the standard system (macOS)	4.0.13.5	Download	Download	844.9 MB
Public SDK package for the standard system (macOS-M1)	4.0.13.5	Download	Download	797.3 MB
Public SDK package for the standard system (Windows/Linux)	4.0.13.5	Download	Download	2.0 GB

What's New

This version has the following updates to OpenHarmony 4.0.3 Release.

Change APIs

Chip and Development Board Adaptation

For details about the adaptation status, see SIG_DevBoard.

Resolved Issues

Table 3 Resolved issues

Issue No.	Issue Description
IATPGT	Six test cases fail when the ActsRequestAuthorityTest suite is executed by acts.
IAWMVO	During the pressure test, the process com.ohos.note experiences 2 JS crash incidents, identified by the stack name isFolderMoveIn.
IAHYHO	When users manually select and attempt to delete images from various date categories on the photo page, deletion is only successful for images from the earliest selected date category.
IA4OYK	[Reboot] During the pressure test, the render_service thread in the /system/bin/render_service process encounters a C++ crash, with the crash stack librender_service.z.so.
I9AS1J	For the Swiper component, specifying the arrow size as "100abcd" incorrectly results in an arrow size display of 100 vp.
IAYMZ8	JS crash issue in the Notepad application.
IARU3T	The command parameter is incorrectly passed during cross-device access to HMDFS.
IATWYZ	Security issues for the init process in OpenHarmony 4.0 Release .
IATKYS	Alarms in the host directory of OpenHarmony 4.0 Release.
I9BPOQ	When the dlopen_impl function processes missing dependencies, an exception occurs when the .so file is unloaded, leading to a use-after-free (UAF) vulnerability in OpenHarmony 4.0 Release.
IAREWW	The patch for CVE-2024-26686 led to the failure of the top command.
IAQYHH	Anonymization processing for deviceId.
IAPABG	Logs contain user information.
IAMISK	Static warnings of the napi_generator repository in OpenHarmony 4.0 Release.
IAP63C	There are errors in loading files from absolute paths for plugins.
IANK71	Abnormal deletions in the Gallery HAP archiving process.
IALIBN	Defective logic for the test cases of the xts_hats/hdf/INPUT module.
IALKY4	Security compilation option SP for audio_manager_service in OpenHarmony 4.0 Release.

Fixed Security Vulnerabilities

Table 4 Fixed security vulnerabilities

Issue No.	Issue Description
IAW2QM	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-45492 in the openeuler:expat component
IAW2QF	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-45491 in the openeuler:expat component
IAW2QE	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-45490 in the openeuler:expat component
IAX807	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-41049
IAVP6R	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-8636 in the chromium component
IAVP6O	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-7971 in the chromium component
IAVP6M	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-7535 in the chromium component
IAVP6K	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-7255 in the chromium component
IAVLNU	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-5290 in the wpa supplicant component
IAQ16Z	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-44987
IAQ15F	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-43882
IAO0XJ	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-42305
IAX89Y	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-42131
IAX7YW	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-26720
IAX7XZ	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-27043
IAX7X1	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-26684
IAX7V8	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-26627
IAX7QW	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-46679
IAVP6Q	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-8035 in the chromium component
IAVN2E	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-46713
IAUE85	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-45028
IASJLL	[Vulnerability] [OpenHarmony-4.0-Release] CVE-832718370087374848
IAQJNR	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-45006
IAQJHL	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-42276
IAQ18I	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-43892
IAQ16G	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2022-48877
IAQ158	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-43871
IAQ14R	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-43884
IAQ12T	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-43856
IAQ12G	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-43828
IAO0YL	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-43853
IAJW36	[Vulnerability] [OpenHarmony-4.0-Release] CVE-2024-41098
IAXDG6	[Vulnerability] [OpenHarmony-4.0-Release] CVE-844296718181732352
IAWOD6	[Vulnerability] [OpenHarmony-4.0-Release] CVE-844409455574519808
IAUKDD	[Vulnerability] [OpenHarmony-4.0-Release] CVE-840681230440599552
IAUJWI	[Vulnerability] [OpenHarmony-4.0-Release] CVE-840680534400045056
IAT99G	[Vulnerability] [OpenHarmony-4.0-Release] CVE-836801068271669248