Lucene search

HuaweiCVE-2017-2716

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-2716

2017-11-2219:29:01

CWE-119

huawei

web.nvd.nist.gov

cve-2017-2716

camerafs driver

mate 9

buffer overflow

vulnerability

system privilege

android

system crash

privilege escalation

nvd

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

39.5%

JSON

The camerafs driver in Mate 9 Versions earlier than MHA-AL00BC00B173 has buffer overflow vulnerability. An attacker tricks a user into installing a malicious application which has the system privilege of the Android system and sends a specific parameter to the driver of the smart phone, causing a system crash or privilege escalation.

Affected configurations

Nvd

Node

huaweimate_9_firmwareRange<mha-al00bc00b173

AND

huaweimate_9Match-

VendorProductVersionCPE
huaweimate_9_firmware*cpe:2.3:o:huawei:mate_9_firmware:*:*:*:*:*:*:*:*
huaweimate_9-cpe:2.3:h:huawei:mate_9:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
huawei	mate_9_firmware	*	cpe:2.3:o:huawei:mate_9_firmware::::::::
huawei	mate_9	-	cpe:2.3:h:huawei:mate_9:-:::::::*

CNA Affected

[
  {
    "product": "Mate 9",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Versions earlier than MHA-AL00BC00B173"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20170426-02-smartphone-en

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

39.5%

JSON

Related for CVE-2017-2716