PT-2017-13989 · Huawei · Huawei Mate 10 Pro+3

Publicado 2017-12-22 · Atualizado 2018-01-09 · CVE-2017-15311

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei Mate 10 versions before 8.0.0.120(SP2C00) Huawei Mate 10 Pro versions before 8.0.0.120(SP2C00) Huawei Mate 9 versions before 8.0.0.334(C00) Huawei Mate 9 Pro versions before 8.0.0.334(C00)

Description The baseband modules of the affected Huawei smart phones have a stack overflow issue due to the lack of parameter validation. An attacker could send malicious packets to the smart phones within radio range using a special wireless device, leading to a stack overflow when the baseband module handles these packets. This could allow the attacker to perform a denial of service attack or achieve remote code execution in the baseband module.

Recommendations For Huawei Mate 10 versions before 8.0.0.120(SP2C00), update to version 8.0.0.120(SP2C00) or later. For Huawei Mate 10 Pro versions before 8.0.0.120(SP2C00), update to version 8.0.0.120(SP2C00) or later. For Huawei Mate 9 versions before 8.0.0.334(C00), update to version 8.0.0.334(C00) or later. For Huawei Mate 9 Pro versions before 8.0.0.334(C00), update to version 8.0.0.334(C00) or later.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2017-15311

Produtos afetados

Huawei Mate 10

Huawei Mate 10 Pro

Huawei Mate 9

Huawei Mate 9 Pro

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-15311 · Nota de Segurança
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171125-01-baseband-en · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-15311 · Aviso do Fabricante