CVE-2017-17139

Vulnerability

CVE-2017-17139 is an information leak vulnerability in the date service proxy implementation of Huawei Mate 9 and Mate 9 Pro smartphones. Affected software versions are those before MHA-AL00B 8.0.0.334(C00) for Mate 9 and before LON-AL00B 8.0.0.334(C00) for Mate 9 Pro. The vulnerability allows a malicious application to access kernel date information, potentially leading to the disclosure of sensitive data [1].

Exploitation

An attacker must trick the user into installing a malicious application. Once installed, the application can exploit the vulnerable date service proxy to retrieve kernel date information. No additional authentication or network position is required beyond the user's device access [1].

Impact

Successful exploitation results in the leakage of kernel date data, which may include sensitive information. This is a confidentiality impact, with no direct effect on integrity or availability. The attacker gains access to kernel-level data that could be used in further attacks or to extract sensitive device information [1].

Mitigation

Huawei has released fixed versions: MHA-AL00B 8.0.0.334(C00) for Mate 9 and LON-AL00B 8.0.0.334(C00) for Mate 9 Pro. Users should update their devices to these versions. The software update was provided as part of Huawei's security advisory on 2017-12-13 [1].