CVE Vulnerabilities

CVE-2017-17320

Double Free

Published: Mar 20, 2018 | Modified: Apr 13, 2018
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

Huawei Mate 9 Pro smartphones with software of LON-AL00BC00B139D, LON-AL00BC00B229, LON-L29DC721B188 have a memory double free vulnerability. The system does not manage the memory properly, that frees on the same memory address twice. An attacker tricks the user who has root privilege to install a crafted application, successful exploit could result in malicious code execution.

Weakness

The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.

Affected Software

Name Vendor Start Version End Version
Mate_9_pro_firmware Huawei lon-al00bc00b139d lon-al00bc00b139d
Mate_9_pro_firmware Huawei lon-al00bc00b229 lon-al00bc00b229
Mate_9_pro_firmware Huawei lon-l29dc721b188 lon-l29dc721b188

Potential Mitigations

References