PT-2017-18175 · Huawei · Huawei

Guang Gong + 2 · Published 2017-11-22 · Updated 2017-12-08 · CVE-2017-8169

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Huawei smart phones versions prior to VIE-L09C40B360

Description The issue is caused by a buffer overflow due to the lack of parameter validation. An attacker can trick a user into installing a malicious APP with root privilege, which can send a specific parameter to the smart phone, potentially causing the smartphone to restart or allowing arbitrary code execution.

Recommendations For versions prior to VIE-L09C40B360, update to version VIE-L09C40B360 or later to resolve the issue. As a temporary workaround, consider restricting the installation of APPs to minimize the risk of exploitation. Avoid using parameters that may trigger the buffer overflow until the issue is resolved.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2017-8169

Affected Products

Huawei

References · 3

• http://huawei.com/en/psirt/security-advisories/huawei-sa-20171025-01-overflow-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8169 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8169 · Vendor Advisory