Lucene search

HuaweiCVE-2017-8205

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-8205

2017-11-2219:29:05

CWE-190

huawei

web.nvd.nist.gov

cve-2017-8205

bastet driver

honor 9

huawei

integer overflow

parameter validation

malicious app

root privilege

arbitrary code execution

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

31.1%

JSON

The Bastet driver of Honor 9 Huawei smart phones with software of versions earlier than Stanford-AL10C00B175 has integer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege; the APP can send a specific parameter to the driver of the smart phone, causing arbitrary code execution.

Affected configurations

Nvd

Node

huaweihonor_9_firmwareRange<stanford-al10c00b175

AND

huaweihonor_9Match-

VendorProductVersionCPE
huaweihonor_9_firmware*cpe:2.3:o:huawei:honor_9_firmware:*:*:*:*:*:*:*:*
huaweihonor_9-cpe:2.3:h:huawei:honor_9:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	honor_9_firmware	*	cpe:2.3:o:huawei:honor_9_firmware::::::::
huawei	honor_9	-	cpe:2.3:h:huawei:honor_9:-:::::::*

CNA Affected

[
  {
    "product": "Honor 9",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Versions earlier than Stanford-AL10C00B175"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20170914-02-smartphone-en

www.securityfocus.com/bid/101963

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

0.001

Percentile

31.1%

JSON

Related for CVE-2017-8205