CVE-2019-5225 Memory corruption in P30, Mate 20, P30 Pro

High 7.8 Published 29 Nov 2019 Updated 4 Aug 2024

A buffer overflow in Huawei smartphones allows attackers to execute malicious code via a crafted application, requiring user installation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-5225?

CVE-2019-5225 is a high-severity memory corruption vulnerability in P30, Mate 20, P30 Pro, published on 29 Nov 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

P30, Mate 20, P30 Pro smartphones with software of versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), versions earlier than Hima-AL00B 9.1.0.135(C00E200R2P1), versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12) have a buffer overflow vulnerability on several , the system does not properly validate certain length parameter which an application transports to kernel. An attacker tricks the user to install a malicious application, successful exploit could cause malicious code execution.

Weakness: CWE-120

Which versions are affected by CVE-2019-5225?

It affects 3 products.

Products include Huawei Mate 20 Firmware, Huawei P30 Firmware, Huawei P30 Pro Firmware.

How do I fix CVE-2019-5225?

No fix has been published for CVE-2019-5225 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2019-5225 being exploited?

There is no known exploitation of CVE-2019-5225 in the wild and no public exploit code.

Sources

Also known as GHSA-xxxq-m57r-j966.