Details of VAR-201712-0801

ID

VAR-201712-0801

CVE

CVE-2017-15316

TITLE

Huawei Mate 9 and Mate 9 Pro Dual release vulnerability in smartphone software

Trust: 0.8

sources: JVNDB: JVNDB-2017-011595

DESCRIPTION

The GPU driver of Mate 9 Huawei smart phones with software before MHA-AL00B 8.0.0.334(C00) and Mate 9 Pro Huawei smart phones with software before LON-AL00B 8.0.0.334(C00) has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which triggers double free and causes a system crash or arbitrary code execution. This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Huawei Mate 9 Pro. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the Mali GPU driver. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code under the context of the kernel. HuaweiMate9 and Mate9Pro are both Huawei's smartphone products. GPUdriver is a graphics driver used in it. A dual release vulnerability exists in the GPU driver in versions prior to HuaweiMate9MHA-AL00B8.0.0.334 (C00) and in versions prior to Mate9ProLON-AL00B8.0.0.334 (C00)

Trust: 2.79

sources: NVD: CVE-2017-15316 // JVNDB: JVNDB-2017-011595 // ZDI: ZDI-17-1017 // CNVD: CNVD-2017-38219

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-38219

AFFECTED PRODUCTS

vendor:	huawei	model:	mate 9 pro	scope:	lt	version:	lon-al00b_8.0.0.334\(c00\)	Trust: 1.0
vendor:	huawei	model:	mate 9	scope:	lt	version:	mha-al00b_8.0.0.334\(c00\)	Trust: 1.0
vendor:	huawei	model:	mate 9 pro	scope:	lt	version:	lon-al00b 8.0.0.334(c00)	Trust: 0.8
vendor:	huawei	model:	mate 9	scope:	lt	version:	mha-al00b 8.0.0.334(c00)	Trust: 0.8
vendor:	huawei	model:	mate 9 pro	scope:	-	version:	-	Trust: 0.7
vendor:	huawei	model:	mate <mha-al00b 8.0.0.334	scope:	eq	version:	9	Trust: 0.6
vendor:	huawei	model:	mate pro <lon-al00b 8.0.0.334	scope:	eq	version:	9	Trust: 0.6

sources: ZDI: ZDI-17-1017 // CNVD: CNVD-2017-38219 // JVNDB: JVNDB-2017-011595 // NVD: CVE-2017-15316

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-15316
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-15316
value:	HIGH
Trust: 0.8
ZDI:	CVE-2017-15316
value:	MEDIUM
Trust: 0.7
CNVD:	CNVD-2017-38219
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201710-460
value:	CRITICAL
Trust: 0.6

nvd@nist.gov:	CVE-2017-15316
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
ZDI:	CVE-2017-15316
severity:	MEDIUM
baseScore:	6.9
vectorString:	AV:L/AC:M/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.4
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.7
CNVD:	CNVD-2017-38219
severity:	MEDIUM
baseScore:	6.2
vectorString:	AV:L/AC:H/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	1.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2017-15316
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: ZDI: ZDI-17-1017 // CNVD: CNVD-2017-38219 // JVNDB: JVNDB-2017-011595 // CNNVD: CNNVD-201710-460 // NVD: CVE-2017-15316

PROBLEMTYPE DATA

problemtype:

CWE-415

Trust: 1.8

sources: JVNDB: JVNDB-2017-011595 // NVD: CVE-2017-15316

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201710-460

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201710-460

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-011595

PATCH

title:	huawei-sa-20171201-01-smartphone	url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171201-01-smartphone-en	Trust: 1.5
title:	Huawei mobile phone GPU driver memory double release vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/111819	Trust: 0.6

sources: ZDI: ZDI-17-1017 // CNVD: CNVD-2017-38219 // JVNDB: JVNDB-2017-011595

EXTERNAL IDS

db:	NVD	id:	CVE-2017-15316	Trust: 3.7
db:	JVNDB	id:	JVNDB-2017-011595	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-5337	Trust: 0.7
db:	ZDI	id:	ZDI-17-1017	Trust: 0.7
db:	CNVD	id:	CNVD-2017-38219	Trust: 0.6
db:	CNNVD	id:	CNNVD-201710-460	Trust: 0.6

sources: ZDI: ZDI-17-1017 // CNVD: CNVD-2017-38219 // JVNDB: JVNDB-2017-011595 // CNNVD: CNNVD-201710-460 // NVD: CVE-2017-15316

REFERENCES

url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171201-01-smartphone-en	Trust: 2.3
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-15316	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-15316	Trust: 0.8
url:	http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20171201-01-smartphone-cn	Trust: 0.6

sources: ZDI: ZDI-17-1017 // CNVD: CNVD-2017-38219 // JVNDB: JVNDB-2017-011595 // CNNVD: CNNVD-201710-460 // NVD: CVE-2017-15316

CREDITS

Tencent Keen Security Lab

Trust: 0.7

sources: ZDI: ZDI-17-1017

SOURCES

db:	ZDI	id:	ZDI-17-1017
db:	CNVD	id:	CNVD-2017-38219
db:	JVNDB	id:	JVNDB-2017-011595
db:	CNNVD	id:	CNNVD-201710-460
db:	NVD	id:	CVE-2017-15316

LAST UPDATE DATE

2024-11-23T22:12:43.054000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-17-1017	date:	2018-06-08T00:00:00
db:	CNVD	id:	CNVD-2017-38219	date:	2017-12-27T00:00:00
db:	JVNDB	id:	JVNDB-2017-011595	date:	2018-01-22T00:00:00
db:	CNNVD	id:	CNNVD-201710-460	date:	2017-12-25T00:00:00
db:	NVD	id:	CVE-2017-15316	date:	2024-11-21T03:14:26.947

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-17-1017	date:	2018-06-08T00:00:00
db:	CNVD	id:	CNVD-2017-38219	date:	2017-12-27T00:00:00
db:	JVNDB	id:	JVNDB-2017-011595	date:	2018-01-22T00:00:00
db:	CNNVD	id:	CNNVD-201710-460	date:	2017-10-17T00:00:00
db:	NVD	id:	CVE-2017-15316	date:	2017-12-22T17:29:13.173