Vulnerability-Lookup

CNVD-2017-19188

Vulnerability from cnvd - Published: 2017-08-07

Title

Huawei手机通话模块拒绝服务漏洞（CNVD-2017-19188）

Description

Huawei P10和P10 Plus都是中国华为（Huawei）公司的智能手机产品。call module是其中的一个通话模块。 Huawei P10和P10 Plus中的通话模块存在拒绝服务漏洞。攻击者可通过诱使用户安装恶意应用程序，并发送特定参数到通话模块利用该漏洞导致通话和数据通信进程崩溃。

Severity

中

Patch Name

Huawei手机通话模块拒绝服务漏洞（CNVD-2017-19188）的补丁

Patch Description

Huawei P10和P10 Plus都是中国华为（Huawei）公司的智能手机产品。call module是其中的一个通话模块。 Huawei P10和P10 Plus中的通话模块存在拒绝服务漏洞。攻击者可通过诱使用户安装恶意应用程序，并发送特定参数到通话模块利用该漏洞导致通话和数据通信进程崩溃。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20170725-02-smartphone-cn

Reference

http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20170725-02-smartphone-cn

Impacted products

Name
['Huawei P10 Plus < VKY-AL00C00B167', 'Huawei P10 Plus < VKY-TL00C01B167', 'Huawei P10 < VTR-AL00C00B167', 'Huawei P10 < VTR-TL00C01B167']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-8146"
    }
  },
  "description": "Huawei P10\u548cP10 Plus\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u667a\u80fd\u624b\u673a\u4ea7\u54c1\u3002call module\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u901a\u8bdd\u6a21\u5757\u3002\r\n\r\nHuawei P10\u548cP10 Plus\u4e2d\u7684\u901a\u8bdd\u6a21\u5757\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bf1\u4f7f\u7528\u6237\u5b89\u88c5\u6076\u610f\u5e94\u7528\u7a0b\u5e8f\uff0c\u5e76\u53d1\u9001\u7279\u5b9a\u53c2\u6570\u5230\u901a\u8bdd\u6a21\u5757\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u901a\u8bdd\u548c\u6570\u636e\u901a\u4fe1\u8fdb\u7a0b\u5d29\u6e83\u3002",
  "discovererName": "Erez Yalon",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20170725-02-smartphone-cn",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-19188",
  "openTime": "2017-08-07",
  "patchDescription": "Huawei P10\u548cP10 Plus\u90fd\u662f\u4e2d\u56fd\u534e\u4e3a\uff08Huawei\uff09\u516c\u53f8\u7684\u667a\u80fd\u624b\u673a\u4ea7\u54c1\u3002call module\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u901a\u8bdd\u6a21\u5757\u3002\r\n\r\nHuawei P10\u548cP10 Plus\u4e2d\u7684\u901a\u8bdd\u6a21\u5757\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bf1\u4f7f\u7528\u6237\u5b89\u88c5\u6076\u610f\u5e94\u7528\u7a0b\u5e8f\uff0c\u5e76\u53d1\u9001\u7279\u5b9a\u53c2\u6570\u5230\u901a\u8bdd\u6a21\u5757\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u901a\u8bdd\u548c\u6570\u636e\u901a\u4fe1\u8fdb\u7a0b\u5d29\u6e83\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Huawei\u624b\u673a\u901a\u8bdd\u6a21\u5757\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2017-19188\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Huawei P10 Plus \u003c VKY-AL00C00B167",
      "Huawei P10 Plus \u003c VKY-TL00C01B167",
      "Huawei P10 \u003c VTR-AL00C00B167",
      "Huawei P10 \u003c VTR-TL00C01B167"
    ]
  },
  "referenceLink": "http://www.huawei.com/cn/psirt/security-advisories/2017/huawei-sa-20170725-02-smartphone-cn",
  "serverity": "\u4e2d",
  "submitTime": "2017-07-27",
  "title": "Huawei\u624b\u673a\u901a\u8bdd\u6a21\u5757\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2017-19188\uff09"
}

CVE-2017-8146 (GCVE-0-2017-8146)

Vulnerability from cvelistv5 – Published: 2017-11-22 19:00 – Updated: 2024-09-16 20:21

Summary

The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167, versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication process.

Severity

No CVSS data available.

CWE

Assigner

huawei mitre root Scorecard

References

1 reference

URL	Tags
http://www.huawei.com/en/psirt/security-advisorie…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
Huawei Technologies Co., Ltd.	P10, P10 Plus	Affected: The versions before VTR-AL00C00B167, The versions before VTR-TL00C01B167, The versions before VKY-AL00C00B167, The vertions before VKY-TL00C01B167

Date Public

2017-11-15 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:27:22.800Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-02-smartphone-en"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "P10, P10 Plus",
          "vendor": "Huawei Technologies Co., Ltd.",
          "versions": [
            {
              "status": "affected",
              "version": "The versions before VTR-AL00C00B167, The versions before VTR-TL00C01B167, The versions before VKY-AL00C00B167, The vertions before VKY-TL00C01B167"
            }
          ]
        }
      ],
      "datePublic": "2017-11-15T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167, versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication process."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "DoS",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-11-27T16:57:01.000Z",
        "orgId": "25ac1063-e409-4190-8079-24548c77ea2e",
        "shortName": "huawei"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-02-smartphone-en"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@huawei.com",
          "DATE_PUBLIC": "2017-11-15T00:00:00",
          "ID": "CVE-2017-8146",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "P10, P10 Plus",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "The versions before VTR-AL00C00B167, The versions before VTR-TL00C01B167, The versions before VKY-AL00C00B167, The vertions before VKY-TL00C01B167"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Huawei Technologies Co., Ltd."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The call module of P10 and P10 Plus smartphones with software versions before VTR-AL00C00B167, versions before VTR-TL00C01B167, versions before VKY-AL00C00B167, versions before VKY-TL00C01B167 has a DoS vulnerability. An attacker may trick a user into installing a malicious application, and the application can send given parameter to call module to crash the call and data communication process."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "DoS"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-02-smartphone-en",
              "refsource": "CONFIRM",
              "url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20170725-02-smartphone-en"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "25ac1063-e409-4190-8079-24548c77ea2e",
    "assignerShortName": "huawei",
    "cveId": "CVE-2017-8146",
    "datePublished": "2017-11-22T19:00:00.000Z",
    "dateReserved": "2017-04-25T00:00:00.000Z",
    "dateUpdated": "2024-09-16T20:21:59.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-19188

CVE-2017-8146 (GCVE-0-2017-8146)

Tags

Sightings

Nomenclature

Related by attack behaviour