PT-2017-18168 · Huawei · Huawei Smartphone

Yonggang Guo · Published 2017-11-22 · Updated 2017-12-12 · CVE-2017-8160

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Huawei smart phones with software versions earlier than Vicky-AL00AC00B172 Huawei smart phones with software version Vicky-AL00CC768B122 Huawei smart phones with software version Vicky-TL00AC01B167 Huawei smart phones with software versions earlier than Victoria-AL00AC00B172 Huawei smart phones with software version Victoria-TL00AC00B123 Huawei smart phones with software version Victoria-TL00AC01B167

Description The issue is related to a use after free (UAF) vulnerability in the Madapt Driver of some Huawei smart phones. An attacker can exploit this vulnerability by tricking a user into installing a malicious application with high privilege. Successful exploitation may cause arbitrary code execution.

Recommendations For versions earlier than Vicky-AL00AC00B172, update to version Vicky-AL00AC00B172 or later. For version Vicky-AL00CC768B122, update to a version that includes the fix for this issue. For version Vicky-TL00AC01B167, update to a version that includes the fix for this issue. For versions earlier than Victoria-AL00AC00B172, update to version Victoria-AL00AC00B172 or later. For version Victoria-TL00AC00B123, update to a version that includes the fix for this issue. For version Victoria-TL00AC01B167, update to a version that includes the fix for this issue.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2017-8160

Affected Products

Huawei Smartphone

References · 3

• https://osv.dev/vulnerability/CVE-2017-8160 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-smartphone-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8160 · Security Note