9.3

CVE-2017-8160

The Madapt Driver of some Huawei smart phones with software Earlier than Vicky-AL00AC00B172 versions,Vicky-AL00CC768B122,Vicky-TL00AC01B167,Earlier than Victoria-AL00AC00B172 versions,Victoria-TL00AC00B123,Victoria-TL00AC01B167 has a use after free (UAF) vulnerability. An attacker can trick a user to install a malicious application which has a high privilege to exploit this vulnerability, Successful exploitation may cause arbitrary code execution.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Huawei ≫ Vicky-al00a Firmware Version < vicky-al00ac00b172
   Huawei ≫ Vicky-al00a Version -
Huawei ≫ Vicky-al00c Firmware Version vicky-al00cc768b122
   Huawei ≫ Vicky-al00c Version -
Huawei ≫ Vicky-tl00a Firmware Version vicky-tl00ac01b167
   Huawei ≫ Vicky-tl00a Version -
Huawei ≫ Victoria-al00a Firmware Version < victoria-al00ac00b172_
   Huawei ≫ Victoria-al00a Version -
Huawei ≫ Victoria-tl00a Firmware Version victoria-tl00ac00b123
   Huawei ≫ Victoria-tl00a Version -
Huawei ≫ Victoria-tl00a Firmware Version victoria-tl00ac01b167
   Huawei ≫ Victoria-tl00a Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.07% 0.604
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20171018-01-smartphone-en
Vendor Advisory