CVE-2017-17324

Vulnerability

In Huawei Mate 9 Pro smartphones with firmware versions LON-AL00BC00B139D and LON-AL00BC00B229, the camera driver does not properly validate external input parameters. This flaw causes an integer overflow, which subsequently leads to a buffer overflow in post-processing. The affected product is the Mate 9 Pro running the listed software versions [1].

Exploitation

An attacker must trick the user into installing a crafted application. No other authentication or network position is required; the malicious code executes within the context of the camera driver after the user installs and runs the application. The sequence involves the application sending specially crafted parameters to the camera driver, triggering the integer overflow and resulting buffer overflow [1].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the device. The compromise likely occurs at the kernel or system level, given the driver's elevated privileges, leading to full control of the device and potential data disclosure or persistent access [1].

Mitigation

Huawei released software update version 8.0.0.334(C00) to fix this vulnerability. Users on affected firmware LON-AL00BC00B139D or LON-AL00BC00B229 should update to the resolved version. The advisory was published on 2018-01-24. No workaround was provided; patching is the only mitigation. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities catalog as of this writing [1].