CVE-2019-5228: huawei honor_v20_firmware Race Condition

Vulnerability summary

CVE-2019-5228 is a high (CVSS 7.8) Race Condition vulnerability in huawei honor_v20_firmware. EPSS estimates a 0.65% chance of exploitation in the next 30 days, higher than 50.1% of scored vulnerabilities.

Timeline

1. 12-11-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Certain detection module of P30, P30 Pro, Honor V20 smartphone whith Versions earlier than ELLE-AL00B 9.1.0.193(C00E190R1P21), Versions earlier than VOGUE-AL00A 9.1.0.193(C00E190R1P12), Versions earlier than Princeton-AL10B 9.1.0.233(C00E233R4P3) have a race condition vulnerability. The system does not lock certain function properly, when the function is called by multiple processes could cause out of bound write. An attacker tricks the user into installing a malicious application, successful exploit could cause malicious code execution.

• CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.