CVE-2020-9113

Vulnerability

A buffer overflow vulnerability exists in the Bluetooth module of Huawei Mate 20 devices running versions earlier than 10.0.0.188(C00E74R3P8). Due to insufficient input validation, an unauthenticated attacker can craft malicious Bluetooth messages after successfully pairing with the device, causing a buffer overflow. [1]

Exploitation

To exploit this vulnerability, an attacker must first establish a Bluetooth pairing with the target device. After pairing, the attacker sends specially crafted Bluetooth messages that trigger the buffer overflow due to insufficient input validation. No additional authentication is required beyond the initial pairing. [1]

Impact

Successful exploitation of the buffer overflow can lead to arbitrary code execution on the affected device. This compromises the confidentiality, integrity, and availability of the device, potentially allowing the attacker to gain full control. [1]

Mitigation

Huawei has released a software update to address this vulnerability. The fixed version is 10.0.0.188(C00E74R3P8). Users are advised to update their devices to this version or later. No workarounds are provided in the available references. [1]