CVE-2019-5216

There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones versions earlier than Columbia-AL10B 9.0.0.156(C00E156R1P20T8) and Honor Play smartphones versions earlier than Cornell-AL00A 9.0.0.156(C00E156R1P13T8). An attacker tricks the user into installing a malicious application, which makes multiple processes to operate the same variate at the same time. Successful exploit could cause execution of malicious code.

CVSS v3 7.0 HIGH
CVSS v2.0 7.6 HIGH

7.0^/10

CVSS v3 : HIGH

Vector : AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability : 1.0 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.6^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 4.9 / Impact : 10.0

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190116-01-smartphone-en	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:huawei:honor_view_10_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:honor_view_10:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:huawei:honor_10_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:honor_10:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:huawei:honor_play_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:huawei:honor_play:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-06-06 15:29

Updated : 2024-02-28 17:08

NVD link : CVE-2019-5216

Mitre link : CVE-2019-5216

CVE.ORG link : CVE-2019-5216

JSON object : View

Products Affected

huawei

honor_10_firmware
honor_view_10
honor_play
honor_play_firmware
honor_10
honor_view_10_firmware

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2019-5216", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.0, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.0}]}, "published": "2019-06-06T15:29:01.157", "references": [{"url": "http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20190116-01-smartphone-en", "tags": ["Vendor Advisory"], "source": "psirt@huawei.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "There is a race condition vulnerability on Huawei Honor V10 smartphones versions earlier than Berkeley-AL20 9.0.0.156(C00E156R2P14T8), Honor 10 smartphones versions earlier than Columbia-AL10B 9.0.0.156(C00E156R1P20T8) and Honor Play smartphones versions earlier than Cornell-AL00A 9.0.0.156(C00E156R1P13T8). An attacker tricks the user into installing a malicious application, which makes multiple processes to operate the same variate at the same time. Successful exploit could cause execution of malicious code."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de condici\u00f3n de carrera en tel\u00e9fonos inteligentes Honor V10 de Huawei en versiones anteriores a Berkeley-AL20 9.0.0.156 (C00E156R2P14T8), tel\u00e9fonos inteligentes Honor 10 versiones anteriores a Columbia-AL10B 9.0.0.156 (C00E156R1P20T8) y tel\u00e9fonos inteligentes Honor Play versiones anteriores a Cornell-AL00A 9.0 .0.156 (C00E156R1P13T8). Un atacante enga\u00f1a al usuario para instalar una aplicaci\u00f3n maliciosa, que permite a m\u00faltiples procesos operar la misma variable al mismo tiempo. La explotaci\u00f3n con \u00e9xito podr\u00eda causar la ejecuci\u00f3n de c\u00f3digo malicioso."}], "lastModified": "2019-06-10T14:02:53.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:honor_view_10_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A52F1C13-42C9-4B49-9F54-A995A14EB442", "versionEndExcluding": "berkeley-al20_9.0.0.156\\(c00e156r2p14t8\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:honor_view_10:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E788B81C-69DB-4A13-AC70-1E17120CB82E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:honor_10_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95BCC442-4B91-4B1F-B566-279B27C206D4", "versionEndExcluding": "columbia-al10b_9.0.0.156\\(c00e156r1p20t8\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:honor_10:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6645D5D7-213C-4B3E-B5A6-8987AEFB411D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:huawei:honor_play_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4504500-777C-4C07-AE8D-B7E08BDA7D1B", "versionEndExcluding": "cornell-al00a_9.0.0.156\\(c00e156r1p13t8\\)"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:huawei:honor_play:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9B4BC963-31B0-4731-8D15-3EFD00E463BE"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@huawei.com"}