PT-2024-3509 · Huawei · Huawei Matebook D16

Published 2024-04-17 · Updated 2025-01-17 · CVE-2023-52710

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Huawei Matebook D16 (Model: CREM-WXX9, BIOS: v2.26)

Description The issue is related to insufficient validation of exceptional states in the UEFI (BIOS) firmware of Huawei personal computers. This can be exploited by a malicious OS attacker to corrupt data structures stored at the beginning of SMRAM, potentially leading to code execution in SMM. The communication buffer size has not been properly validated, allowing it to partially overlap with the beginning of SMRAM.

Recommendations For Huawei Matebook D16 (Model: CREM-WXX9, BIOS: v2.26), consider updating the BIOS to a version that properly validates the communication buffer size to prevent overlap with SMRAM and potential code execution in SMM. As a temporary workaround, restrict access to sensitive areas of SMRAM to minimize the risk of exploitation.

Fix

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2024-03811

CVE-2023-52710

Affected Products

Huawei Matebook D16

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-52710 · Security Note
• https://osv.dev/vulnerability/CVE-2023-52710 · Vendor Advisory
• https://huawei.com/en/psirt/security-advisories/2024/huawei-sa-hppvticfuoec-8ffde288-en · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03811 · Security Note
• https://cybersecurity-help.cz/vdb/SB20240417117 · Note
• https://t.me/cvenotify/81112 · Telegram Post