CVE-2020-9247

Vulnerability

A buffer overflow vulnerability exists in several Huawei smartphone products, including HONOR 20 PRO, Mate 20, Mate 20 Pro, Mate 20 X, P30, P30 Pro, Hima-L29C, Laya-AL00EP, Princeton-AL10B, Tony-AL00B, Yale-L61A, Yale-TL00B, and YaleP-AL10B. The system does not sufficiently validate a certain configuration parameter passed from the user, causing a buffer overflow [1]. Affected versions are those earlier than specified resolved builds (e.g., 10.1.0.230(C432E9R5P1) for HONOR 20 PRO) [1].

Exploitation

The attacker must trick the user into installing and running a malicious application with high privileges [1]. No other preconditions such as network access or user interaction beyond installing the app are mentioned. The specific sequence of steps is not detailed in the available references.

Impact

Successful exploitation could lead to code execution on the device, potentially allowing the attacker to take control of the affected smartphone [1]. The exact scope of compromise (e.g., user-space vs kernel) or CIA impact beyond arbitrary code execution is not further elaborated in the references.

Mitigation

Huawei has released software updates to fix this vulnerability [1]. The resolved versions are listed for each product, for example, HONOR 20 PRO is fixed in version 10.1.0.230(C432E9R5P1). Users should update their devices to the latest available firmware. No workarounds are provided in the advisory. The CVE is not known to be listed on the CISA KEV.