A vulnerability classified as critical has been found in Huawei Honor 5C and Honor 6X (affected version not known). Affected is some unknown functionality of the component Driver. The manipulation as part of a Parameter leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The driver of honor 5C,honor 6x Huawei smart phones with software of versions earlier than NEM-AL10C00B356, versions earlier than Berlin-L21HNC432B360 have a buffer overflow vulnerability due to the lack of parameter validation. An attacker tricks a user into installing a malicious APP which has the root privilege of the Android system, the APP can send a specific parameter to the driver of the smart phone, causing a system reboot or arbitrary code execution.

The bug was discovered 08/04/2017. The weakness was shared 11/22/2017 (Website). The advisory is shared for download at huawei.com. This vulnerability is traded as CVE-2017-8209 since 04/25/2017. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 110 days. During that time the estimated underground price was around $5k-$25k.

Upgrading eliminates this vulnerability.

The entries VDB-109942, VDB-109943, VDB-109945 and VDB-109946 are related to this item.

Productinfo

Vendor

• Huawei

Name

• Honor 5C
• Honor 6X

License

• commercial

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion