CVE-2016-8762 Denial of service in P9,P9 Lite,P8 Lite Versions earlier than EVA-AL10C00B352,VNS-L21C185B130 and earlier versions,ALE-L02C636B150 and earlier versions

Medium 5.0 Published 2 Apr 2017 Updated 6 Aug 2024

Attackers can cause Huawei P9, P9 Lite, and P8 Lite devices to restart via an input validation flaw in the TrustZone driver.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2016-8762?

CVE-2016-8762 is a medium-severity denial of service vulnerability in P9,P9 Lite,P8 Lite Versions earlier than EVA-AL10C00B352,VNS-L21C185B130 and earlier versions,ALE-L02C636B150 and earlier versions, published on 2 Apr 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an input validation vulnerability, which allows attackers to cause the system to restart.

Weakness: CWE-20

Which versions are affected by CVE-2016-8762?

It affects 3 products.

Products include Huawei P8 Lite Firmware, Huawei P9 Firmware, Huawei P9 Lite Firmware.

How do I fix CVE-2016-8762?

No fix has been published for CVE-2016-8762 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2016-8762 being exploited?

There is no known exploitation of CVE-2016-8762 in the wild and no public exploit code.

Sources

Also known as GHSA-7gpm-629q-g6v7.