In addition to Google's effort on patching exploits and vulnerabilities through the Android Monthly Security Update program, several OEMs have also been more upfront about disclosing any devices-specific vulnerabilities they find and patch.
Huawei had previously found an Arbitrary Memory Read/Write vulnerability on the Mate 9 and Mate 9 Pro, which was subsequently patched through a software update. Now, Huawei has found a vulnerability on the P9 Plus that can cause the system to crash, thanks to efforts by members of the 360 Vulpecker team.
The vibrator service of the Huawei P9 Plus before the B386 update has a Denial of Service vulnerability due to a lack of parameter checking. An attacker can send a given parameter to the vibrator service interface through a malicious application installed on the phone, and subsequently crash the system. While this by itself may only result in data loss, chaining the effects of this vulnerability could enable the attacker to potentially create ransomware that does not allow use of the phone unless their demands are met. There have been no mentions of any cases of this exploit being used as such, though.
This vulnerability has been assigned CVE ID: CVE-2017-2731, and has been patched through the B386 update for the phone. Huawei notes that the vulnerability can be exploited only after an attacker has successfully tricked a user into installing a malicious application on the phone. A good precaution would be to keep an eye on what applications are installed on your phone, as always. Since this vulnerability exists regardless of root or bootloader status, it can cause system crashes on all Huawei P9 Plus devices that are on versions prior to the B386 update.
Huawei recommends installing the update that will be automatically pushed to affected devices. You can read more about the vulnerability over at Huawei's Security Advisory Board.
Source: Huawei Security Advisory Blog
from xda-developers http://ift.tt/2mPrj2V
via IFTTT
No comments:
Post a Comment