CVE-2016-8764 Memory corruption in P9,P9 Lite,P8 Lite Versions earlier than EVA-AL10C00B352,VNS-L21C185B130 and earlier versions,ALE-L02C636B150 and earlier versions

Medium 6.4 Published 2 Apr 2017 Updated 6 Aug 2024

Attackers can read and write arbitrary user-mode memory in the TrustZone driver due to input validation flaws in Huawei P9, P9 Lite, and P8 Lite devices.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2016-8764?

CVE-2016-8764 is a medium-severity memory corruption vulnerability in P9,P9 Lite,P8 Lite Versions earlier than EVA-AL10C00B352,VNS-L21C185B130 and earlier versions,ALE-L02C636B150 and earlier versions, published on 2 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

The TrustZone driver in Huawei P9 phones with software Versions earlier than EVA-AL10C00B352 and P9 Lite with software VNS-L21C185B130 and earlier versions and P8 Lite with software ALE-L02C636B150 and earlier versions has an input validation vulnerability, which allows attackers to read and write user-mode memory data anywhere in the TrustZone driver.

Weakness: CWE-20

Which versions are affected by CVE-2016-8764?

It affects 3 products.

Products include Huawei P8 Lite Firmware, Huawei P9 Firmware, Huawei P9 Lite Firmware.

How do I fix CVE-2016-8764?

No fix has been published for CVE-2016-8764 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2016-8764 being exploited?

There is no known exploitation of CVE-2016-8764 in the wild and no public exploit code.

Sources

Also known as GHSA-q44f-95xp-jm2w.