CVE-2020-9103

Vulnerability

A logic error exists in Huawei Mate 20 smartphones running version 9.0.0.205(C00E205R2P1). In a specific scenario, the system fails to properly process certain operations, allowing an attacker to establish P2P (peer-to-peer) connections that would normally be rejected by the peer end. The vulnerability is identified as HWPSIRT-2019-08040 [1].

Exploitation

An attacker in a position to perform network operations can carry out a series of steps to force a P2P connection with a peer device that would otherwise refuse it. No authentication or user interaction beyond being in the same network proximity is mentioned in the available references, though the exact sequence of operations required is not detailed [1].

Impact

Successful exploitation affects the availability of the device. The attacker can force the establishment of unwanted P2P connections, which may lead to denial of service or other availability degradation. The confidentiality and integrity of data are not reported to be impacted [1].

Mitigation

Huawei has released a software update to fix this vulnerability. The resolved version for the HUAWEI Mate 20 is 10.0.0.175(C00E70R3P8). Users should update their devices to this or a later version. The advisory was published on 2020-08-12 [1]. No workarounds are provided in the reference.