CVE-2018-7899

Vulnerability

The Mali Driver in Huawei Berkeley-AL20 and Berkeley-BD smart phones contains a double free vulnerability that can be triggered during exception handling. Affected Berkeley-AL20 versions include 8.0.0.105(C00) through 8.0.0.151(C00), and Berkeley-BD versions include 1.0.0.21 through 1.0.0.29 [1]. The vulnerability resides in the kernel-level graphics driver, which is reachable when a malicious application triggers the vulnerable code path during an exception processing event.

Exploitation

An attacker must first trick the user into installing a malicious application [1]. No additional privileges or network access are required beyond normal app permissions. Once installed, the malicious app triggers the exception handling process, causing the Mali Driver to free the same memory object twice. The exploitation sequence does not require root access or user interaction beyond the initial installation.

Impact

Successful exploitation of the double free vulnerability leads to memory corruption, which can cause the system to reboot [1]. The impact is a denial of service (availability loss); the advisory does not indicate code execution or privilege escalation.

Mitigation

Huawei released software updates to fix this vulnerability. For Berkeley-AL20, the resolved version is 8.0.0.160(C00); users should upgrade to this or a later version [1]. For Berkeley-BD, the fixed version has not been specified in the available references; users should contact Huawei support or check for updates. The advisory was published on 18 April 2018.