CVE-2019-5236

Vulnerability

A double free vulnerability exists in Huawei Emily-L29C smart phones running specific versions: 8.1.0.132a(C432), 8.1.0.135(C782), 8.1.0.154(C10), 8.1.0.154(C461), 8.1.0.154(C635), 8.1.0.156(C185), 8.1.0.156(C605), and 8.1.0.159(C636) [1]. The vulnerability is triggered when a user clicks a crafted URL, leading to a double free condition in the affected software.

Exploitation

An attacker must trick a user into clicking a malicious URL, which can be delivered via phishing or other social engineering methods [1]. No additional authentication or network position is required beyond the user's interaction. The exact sequence of steps is not detailed in the advisory, but the double free occurs during URL handling.

Impact

Successful exploitation may cause the affected phone to behave abnormally [1]. The advisory does not specify the exact consequences, but double free vulnerabilities often lead to denial of service, memory corruption, or potential code execution. The impact is limited to the device's stability.

Mitigation

Huawei has released software updates to fix this vulnerability. Users should upgrade their Emily-L29C devices to the resolved version 9.1.0.311 (specific builds per variant) [1]. No workarounds are provided. The advisory was published on August 7, 2019.