Security Advisory - Authentication Bypass Vulnerability in Some Huawei Smart Phones

The soundtrigger module of some Huawei smart phones has an authentication bypass vulnerability due to the improper design of the module. An attacker tricks a user into installing a malicious application, and the application can exploit the vulnerability to replace related authentication information, which make the attacker can wake up the phone and control it to sent short messages and make call within audio range to the phone. (Vulnerability ID: HWPSIRT-2017-10093)
This vulnerability has been assigned a CVE ID: CVE-2017-17279.
Huawei has released software updates to fix this vulnerability. This advisory is available at the following link:
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180307-01-smartphone-en