CVE-2018-7989

Vulnerability

The vulnerability resides in the App Lock function of Huawei Mate 10 Pro smartphones running versions prior to BLA-AL00B 8.1.0.326(C00). App Lock is designed to prevent unauthorized use of apps, but due to improper authentication, an attacker can directly change the lock password after a series of operations [1]. Other affected models include ALP-AL00B, ALP-TL00B, and Anne-AL00 running earlier versions [1].

Exploitation

An attacker needs physical access to the device to perform a series of operations that bypass the App Lock authentication mechanism. No prior credentials are required. The exact steps are not detailed in the advisory, but the attack does not require additional privileges beyond device access [1].

Impact

Successful exploitation allows the attacker to change the App Lock password and subsequently use any protected applications. This leads to unauthorized access to private app data, compromising confidentiality. The attacker gains the ability to bypass the intended security control of App Lock [1].

Mitigation

Huawei has released software updates to fix this vulnerability. For the Mate 10 Pro (BLA-AL00B), the resolved version is 8.1.0.326(C00). Users should update to this version or later. The advisory was published on 2018-10-10 [1].