Huawei Nice-AL00 Camera Driver Application memory corruption

Summaryinfo

A vulnerability has been found in Huawei Nice-AL00 and classified as critical. Impacted is an unknown function of the component Camera Driver. Performing a manipulation as part of Application results in memory corruption. This vulnerability is reported as CVE-2017-8181. The attack requires a local approach. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in Huawei Nice-AL00 (the affected version unknown). This affects an unknown part of the component Camera Driver. The manipulation as part of a Application leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The camera driver of MTK platform in Huawei smart phones with software of versions earlier than Nice-AL00C00B155 has a arbitrary memory write vulnerability.Due to the insufficient input verification, an attacker tricks a user into installing a malicious application which has special privilege and sends a specific parameter to the driver of the smart phone, causing privilege escalation.

The bug was discovered 09/19/2017. The weakness was disclosed 11/22/2017 (Website). The advisory is shared at huawei.com. This vulnerability is uniquely identified as CVE-2017-8181 since 04/25/2017. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available.

The vulnerability was handled as a non-public zero-day exploit for at least 64 days. During that time the estimated underground price was around $5k-$25k.

Upgrading eliminates this vulnerability.

The entries VDB-109915 and VDB-109916 are pretty similar. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Huawei

Name

• Nice-AL00

License

• commercial

Website

• Vendor: https://www.huawei.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion