CVE-2017-15318

Vulnerability

RP200 (V500R002C00, V600R006C00), TE30 (V100R001C10, V500R002C00, V600R006C00), TE40 (V500R002C00, V600R006C00), TE50 (V500R002C00, V600R006C00), and TE60 (V100R001C10, V500R002C00, V600R006C00) contain an out-of-bounds read vulnerability due to insufficient input validation of SS7 related packets [1]. A remote attacker can send specially crafted SS7 packets to trigger the flaw [1].

Exploitation

The attacker requires network access to send malicious SS7 packets to the target device; no authentication is needed [1]. The vulnerability is triggered by sending a specially crafted SS7 packet, which is processed without proper bounds checking, causing the system to read memory beyond an allocated buffer [1].

Impact

Successful exploitation results in an out-of-bounds read, which can cause the system to crash, leading to a denial of service [1]. The CIA impact is primarily availability loss, though out-of-bounds reads may also expose sensitive memory contents [1].

Mitigation

Huawei has released software updates: upgrade RP200 to TEX0 V600R006C00SPC400, TE30 to V600R006C00SPC400, TE40 to V600R006C00SPC400, TE50 to V600R006C00SPC400, and TE60 to V600R006C00SPC400 [1]. The advisory was published 2017-11-01 [1]. No workaround is documented; applying the patch is the only mitigation [1].