Details of VAR-201803-0198

ID

VAR-201803-0198

CVE

CVE-2017-17320

TITLE

Huawei Mate 9 Pro Vulnerability related to double release in smartphones

Trust: 0.8

sources: JVNDB: JVNDB-2017-012982

DESCRIPTION

Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could result in malicious code execution. Huawei Mate 9 Pro Smartphones contain a double release vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. HuaweiMate9Pro is a smartphone from China's Huawei company. There is a memory release vulnerability in HuaweiMate9Pro

Trust: 2.25

sources: NVD: CVE-2017-17320 // JVNDB: JVNDB-2017-012982 // CNVD: CNVD-2018-05336 // VULHUB: VHN-108331

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-05336

AFFECTED PRODUCTS

vendor:	huawei	model:	mate 9 pro	scope:	eq	version:	lon-al00bc00b139d	Trust: 2.4
vendor:	huawei	model:	mate 9 pro	scope:	eq	version:	lon-al00bc00b229	Trust: 2.4
vendor:	huawei	model:	mate 9 pro	scope:	eq	version:	lon-l29dc721b188	Trust: 2.4
vendor:	huawei	model:	mate pro lon-al00bc00b139d	scope:	eq	version:	9	Trust: 0.6
vendor:	huawei	model:	mate pro lon-al00bc00b229	scope:	eq	version:	9	Trust: 0.6
vendor:	huawei	model:	mate pro lon-l29dc721b188	scope:	eq	version:	9	Trust: 0.6

sources: CNVD: CNVD-2018-05336 // JVNDB: JVNDB-2017-012982 // CNNVD: CNNVD-201803-717 // NVD: CVE-2017-17320

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-17320
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-17320
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2018-05336
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201803-717
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-108331
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2017-17320
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-05336
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
VULHUB:	VHN-108331
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-17320
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: CNVD: CNVD-2018-05336 // VULHUB: VHN-108331 // JVNDB: JVNDB-2017-012982 // CNNVD: CNNVD-201803-717 // NVD: CVE-2017-17320

PROBLEMTYPE DATA

problemtype:

CWE-415

Trust: 1.9

sources: VULHUB: VHN-108331 // JVNDB: JVNDB-2017-012982 // NVD: CVE-2017-17320

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201803-717

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201803-717

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-012982

PATCH

title:	huawei-sa-20180314-02-smartphone	url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180314-02-smartphone-en	Trust: 0.8
title:	HuaweiMate9Pro memory release vulnerability patch	url:	https://www.cnvd.org.cn/patchInfo/show/121585	Trust: 0.6
title:	Huawei Mate 9 Pro Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=79317	Trust: 0.6

sources: CNVD: CNVD-2018-05336 // JVNDB: JVNDB-2017-012982 // CNNVD: CNNVD-201803-717

EXTERNAL IDS

db:	NVD	id:	CVE-2017-17320	Trust: 3.1
db:	JVNDB	id:	JVNDB-2017-012982	Trust: 0.8
db:	CNNVD	id:	CNNVD-201803-717	Trust: 0.7
db:	CNVD	id:	CNVD-2018-05336	Trust: 0.6
db:	VULHUB	id:	VHN-108331	Trust: 0.1

sources: CNVD: CNVD-2018-05336 // VULHUB: VHN-108331 // JVNDB: JVNDB-2017-012982 // CNNVD: CNNVD-201803-717 // NVD: CVE-2017-17320

REFERENCES

url:	http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180314-02-smartphone-en	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-17320	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-17320	Trust: 0.8
url:	http://www.huawei.com/cn/psirt/security-advisories/2018/huawei-sa-20180314-02-smartphone-cn	Trust: 0.6

sources: CNVD: CNVD-2018-05336 // VULHUB: VHN-108331 // JVNDB: JVNDB-2017-012982 // CNNVD: CNNVD-201803-717 // NVD: CVE-2017-17320

SOURCES

db:	CNVD	id:	CNVD-2018-05336
db:	VULHUB	id:	VHN-108331
db:	JVNDB	id:	JVNDB-2017-012982
db:	CNNVD	id:	CNNVD-201803-717
db:	NVD	id:	CVE-2017-17320

LAST UPDATE DATE

2024-11-23T22:45:25.910000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-05336	date:	2018-03-15T00:00:00
db:	VULHUB	id:	VHN-108331	date:	2018-04-13T00:00:00
db:	JVNDB	id:	JVNDB-2017-012982	date:	2018-05-15T00:00:00
db:	CNNVD	id:	CNNVD-201803-717	date:	2018-03-21T00:00:00
db:	NVD	id:	CVE-2017-17320	date:	2024-11-21T03:17:49.870

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-05336	date:	2018-03-15T00:00:00
db:	VULHUB	id:	VHN-108331	date:	2018-03-20T00:00:00
db:	JVNDB	id:	JVNDB-2017-012982	date:	2018-05-15T00:00:00
db:	CNNVD	id:	CNNVD-201803-717	date:	2018-03-21T00:00:00
db:	NVD	id:	CVE-2017-17320	date:	2018-03-20T15:29:00.470