Buffer overflow in Huawei Honor V20
CVE-2019-5228
Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12), Versions earlier than Princeton-AL10B 9.1.0.233(C00E233R4P3) have a race condition vulnerability. The system does not lock certain function properly, when the function is called by multiple processes could cause out of bound write. An attacker tricks the user into installing a malicious application, successful exploit could cause malicious code execution.
Vulnerability class: Race Condition
EPSS: 0.006 (47.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Huawei Honor_v20
- Huawei Honor_v20_firmware
- Huawei P30
- Huawei P30_firmware
- Huawei P30_pro
- Huawei P30_pro_firmware
- N/a P30, P30 Pro, Honor V20 — versions Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12), Versions earlier than Princeton-AL10B 9.1.0.233(C00E233R4P3)
Weakness classification (CWE)
References
- psirt@huawei.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-5228?
- CVE-2019-5228 is a high-severity vulnerability in Huawei Honor V20, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.8/10. Published 2019-11-12.
- How severe is CVE-2019-5228?
- High severity. CVSS v3 base score is 7.8 out of 10.