Vulnerabilities > CVE-2019-5305 - Double Free vulnerability in Huawei Mate 10 Firmware

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

NONE

Availability impact

HIGH

local

low complexity

huawei

CWE-415

NVD

Published: 2019-06-06

Updated: 2019-06-10

Summary

The image processing module of some Huawei Mate 10 smartphones versions before ALP-L29 9.0.0.159(C185) has a memory double free vulnerability. An attacker tricks a user into installing a malicious application, and the application can call special API, which could trigger double free and cause a system crash.

Vulnerable Configurations

Part	Description	Count
OS	Huawei Huawei Mate 10 Firmware - Huawei Mate 10 Firmware 9.0.0.159\(C432E4R1P9T8\) Huawei Mate 10 Firmware 9.0.0.159\(C636E2R1P12T8\) Huawei Mate 10 Firmware 9.0.0.167\(C00E85R2P20T8\) Huawei Mate 10 Firmware 9.0.0.177\(C185E2R1P12T8\) Huawei Mate 10 Firmware 10.0.0.143\(C00E143R2P4\) Huawei Mate 10 Firmware 10.0.0.189\(C185E6R1P3\) Huawei Mate 10 Firmware Alp-Al00_8.0.0.120\(Sp2C00\) Huawei Mate 10 Firmware Alp-Al00_8.1.0.311 Huawei Mate 10 Firmware Alp-Al00B_9.0.0.167\(C00E85R2P20T8\) Huawei Mate 10 Firmware Alp-Al00B_9.0.0.181\(C00E87R2P20T8\) Huawei Mate 10 Firmware Alp-L09_8.0.0.120\(C212\) Huawei Mate 10 Firmware Alp-L09_8.0.0.127\(C900\) Huawei Mate 10 Firmware Alp-L09_8.0.0.128\(402\) Huawei Mate 10 Firmware Alp-L09_8.0.0.128\(C02\) Huawei Mate 10 Firmware Alp-L09_8.0.0.128\(C109\) Huawei Mate 10 Firmware Alp-L09_8.0.0.128\(C346\) Huawei Mate 10 Firmware Alp-L09_8.0.0.128\(C432\) Huawei Mate 10 Firmware Alp-L09_8.0.0.128\(C652\)	19
Hardware	Huawei Huawei Mate 10 -	1

Common Weakness Enumeration (CWE)

CWE-415 - Double Free

References

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190128-01-ivp-en