PT-2018-6500 · Huawei · Huawei Mate 9 Pro

Published 2018-03-09 · Updated 2018-03-29 · CVE-2017-17324

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Huawei Mate 9 Pro smartphones with software LON-AL00BC00B139D; LON-AL00BC00B229

Description: The issue is related to an integer overflow in the camera driver, which does not properly validate external input parameters. This leads to a buffer overflow after processing, potentially allowing malicious code execution if an attacker tricks a user into installing a crafted application.

Recommendations: For Huawei Mate 9 Pro smartphones with software LON-AL00BC00B139D, consider disabling the camera driver until a patch is available. For Huawei Mate 9 Pro smartphones with software LON-AL00BC00B229, consider disabling the camera driver until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2017-17324

Affected Products

Huawei Mate 9 Pro

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-17324 · Security Note
• https://osv.dev/vulnerability/CVE-2017-17324 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/2018/huawei-sa-20180124-01-smartphone-en · Vendor Advisory