PT-2019-17518 · Huawei · Honor V20+2

Published 2019-11-12 · Updated 2021-07-21 · CVE-2019-5228

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions P30 versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21) P30 Pro versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12) Honor V20 versions earlier than Princeton-AL10B 9.1.0.233(C00E233R4P3)

Description The issue is related to a race condition in a detection module, where the system fails to properly lock certain functions when called by multiple processes, potentially leading to out-of-bounds write. An attacker could exploit this by tricking a user into installing a malicious application, which could result in malicious code execution.

Recommendations For P30 versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), update to version ELLE-AL00B 9.1.0.193(C00E190R1P21) or later. For P30 Pro versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12), update to version VOGUE-AL00A 9.1.0.193(C00E190R1P12) or later. For Honor V20 versions earlier than Princeton-AL10B 9.1.0.233(C00E233R4P3), update to version Princeton-AL10B 9.1.0.233(C00E233R4P3) or later.

Fix

Race Condition

Memory Corruption

Weakness Enumeration

CWE-362

CWE-787

Related Identifiers

CVE-2019-5228

Affected Products

Honor V20

P30

P30 Pro

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-5228 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5228 · Vendor Advisory
• http://huawei.com/en/psirt/security-advisories/huawei-sa-20190911-01-smartphone-en · Vendor Advisory