Security Advisory - DoS Vulnerabilities in Driver of Huawei Smart Phones
- SA No:Huawei-SA-20160105-01-SmartPhone
- Initial Release Date: Jan 05, 2016
- Last Release Date: Feb 03, 2016
There is a Denial of Service (DoS) vulnerability in ION driver and Maxim_smartpa_dev driver in some Huawei smart phones respectively. An attacker may trick a user into installing a malicious application and the application can access invalid address of driver to crash the system. (Vulnerability ID: HWPSIRT-2015-11083 and HWPSIRT-2015-11089)
The vulnerability HWPSIRT-2015-11083 has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-8678, the vulnerability HWPSIRT-2015-11089 has been assigned CVE ID: CVE-2015-8679.
Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160105-01-smartphone-en
|
Product Name |
Affected Version |
Resolved Product and Version |
|
P8[1] |
GRA-TL00C01B220 and earlier versions |
GRA-TL00C01B230 |
|
GRA-CL00C92B220 and earlier versions |
GRA-CL00C92B230 |
|
|
GRA-CL10C92B220 and earlier versions |
GRA-CL10C92B230 |
|
|
GRA-UL00C00B220 and earlier versions |
GRA-UL00C00B230 |
|
|
GRA-UL10C00B220 and earlier versions |
GRA-UL10C00B230 |
|
|
Mate S[1] |
CRR-TL00C01B153SP01 and earlier versions |
CRR-TL00C01B160SP01 |
|
CRR-UL00C00B153 and earlier versions |
CRR-UL00C00B160 |
|
|
CRR-CL00C92B153 and earlier versions |
CRR-CL00C92B161 |
HWPSIRT-2015-11083 & HWPSIRT-2015-11089:
The malicious application installed on smart phone can exploit this vulnerability to crash the system.The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
HWPSIRT-2015-11083 & HWPSIRT-2015-11089:
Base Score: 4.0 (AV:L/AC:H/Au:N/C:N/I:N/A:C)
Temporal Score: 3.3 (E:F/RL:O/RC:C)HWPSIRT-2015-11083 & HWPSIRT-2015-11089:
1. Prerequisite:
The attacker successfully tricks a user into installing a malicious application on the smart phone.
2. Attacking procedure:
There is a DoS vulnerability in ION driver and Maxim_smartpa_dev driver in some Huawei smart phones respectively. An attacker may trick a user into installing a malicious application and the application can access invalid address of driver to crash the system.
1. The product that supports automatic update will receive a system update prompt. You can install the update to fix the vulnerability.
2. Customers should contact Huawei TAC (Huawei Technical Assistance Center) to request the upgrades. For TAC contact information, please refer to Huawei worldwide website at http://www.huawei.com/en/psirt/report-vulnerabilities/index.htm
2016-02-03 V1.1 FINAL updated information of "Software Versions and Fixes"
2016-01-05 V1.0 INITIALNone
