CVE-2017-15311

published 2017-12-22

CVE-2017-15311: The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00…

Priority P3 46 high 8.8 CVSS 3.0

AV A AC L PR N UI N S U C H I H A H

The baseband modules of Mate 10, Mate 10 Pro, Mate 9, Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00), before BLA-AL00 8.0.0.120(SP2C00), before MHA-AL00B 8.0.0.334(C00), and before LON-AL00B 8.0.0.334(C00) have a stack overflow vulnerability due to the lack of parameter validation. An attacker could send malicious packets to the smart phones within radio range by special wireless device, which leads stack overflow when the baseband module handles these packets. The attacker could exploit this vulnerability to perform a denial of service attack or remote code execution in baseband module.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
huawei	mate_10_firmware	< alp-al00_8.0.0.120\(sp2c00\)	alp-al00_8.0.0.120\(sp2c00\)
huawei	mate_10_pro_firmware	< bla-al00_8.0.0.120\(sp2c00\)	bla-al00_8.0.0.120\(sp2c00\)
huawei	mate_9_firmware	< mha-al00b_8.0.0.334\(c00\)	mha-al00b_8.0.0.334\(c00\)
huawei	mate_9_pro_firmware	< lon-al00b_8.0.0.334\(c00\)	lon-al00b_8.0.0.334\(c00\)
huawei_technologies_co_ltd	mate_10	—	—
huawei_technologies_co_ltd	mate_10_pro	—	—
huawei_technologies_co_ltd	mate_9	—	—
huawei_technologies_co_ltd	mate_9_pro	—	—

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 5.8 MEDIUM AV:A/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119