CVE-2017-8148 Race condition in P9

Medium 4.7 Published 22 Nov 2017 Updated 16 Sep 2024

A race condition in the audio driver allows a malicious app to cause a null pointer dereference, leading to a system reboot on Huawei P9 devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2017-8148?

CVE-2017-8148 is a medium-severity vulnerability in Huawei Technologies Co., Ltd. P9, published on 22 Nov 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Audio driver in P9 smartphones with software The versions before EVA-AL10C00B389 has a denial of service (DoS) vulnerability. An attacker tricks a user into installing a malicious application on the smart phone, and the race condition cause null pointer accessing during the application access shared resource, which make the system reboot.

Weakness: CWE-362

Which versions are affected by CVE-2017-8148?

It affects 1 product.

Products include Huawei P9 Firmware.

How do I fix CVE-2017-8148?

No fix has been published for CVE-2017-8148 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-8148 being exploited?

There is no known exploitation of CVE-2017-8148 in the wild and no public exploit code.

Sources

Also known as GHSA-44gj-p79x-95g6.