Lucene search

[email protected]CVE-2017-8160

HistoryNov 22, 2017 - 7:29 p.m.

CVE-2017-8160

2017-11-2219:29:03

CWE-416

[email protected]

web.nvd.nist.gov

huawei

smart phones

uaf

vulnerability

code execution

exploit

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

36.5%

JSON

The Madapt Driver of some Huawei smart phones with software Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than Victoria-AL00AC00B172 versions,Victoria-TL00AC00B123,Victoria-TL00AC01B167 has a use after free (UAF) vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability, Successful exploitation may cause arbitrary code execution.

Affected configurations

NVD

Node

huaweivicky-al00a_firmwareRange<vicky-al00ac00b172

AND

huaweivicky-al00aMatch-

Node

huaweivicky-al00c_firmwareMatchvicky-al00cc768b122

AND

huaweivicky-al00cMatch-

Node

huaweivicky-tl00a_firmwareMatchvicky-tl00ac01b167

AND

huaweivicky-tl00aMatch-

Node

huaweivictoria-al00a_firmwareRange<victoria-al00ac00b172_

AND

huaweivictoria-al00aMatch-

Node

huaweivictoria-tl00a_firmwareMatchvictoria-tl00ac00b123

AND

huaweivictoria-tl00aMatch-

Node

huaweivictoria-tl00a_firmwareMatchvictoria-tl00ac01b167

AND

huaweivictoria-tl00aMatch-

CPENameOperatorVersion
huawei:vicky-al00a_firmwarehuawei vicky-al00a firmwareltvicky-al00ac00b172

CPE	Name	Operator	Version
huawei:vicky-al00a_firmware	huawei vicky-al00a firmware	lt	vicky-al00ac00b172

CNA Affected

[
  {
    "product": "Vicky-AL00A,Vicky-AL00C,Vicky-TL00A,Victoria-AL00A,Victoria-TL00A",
    "vendor": "Huawei Technologies Co., Ltd.",
    "versions": [
      {
        "status": "affected",
        "version": "Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than Victoria-AL00AC00B172 versions,Victoria-TL00AC00B123,Victoria-TL00AC01B167"
      }
    ]
  }
]

References

www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-smartphone-en

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

36.5%

JSON

Related for CVE-2017-8160

cvelist1 nvd1 prion1 huawei1