CVE-2020-9109: There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker n...

Summary

There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, and successful exploit...

What to do

Update huawei p30_pro_firmware to version 10.1.0.160\(c00e160r2p8\) or later.
Update huawei laya-al00ep_firmware to version 10.1.0.160\(c786e160r3p8\) or later.
Update huawei tony-al00b_firmware to version 10.1.0.160\(c00e160r2p11\) or later.
Update huawei tony-tl00b_firmware to version 10.1.0.160\(c01e160r2p11\) or later.

Affected software

Vendor	Product	Affected versions
huawei	mate_20_firmware	< 10.1.0.160\(c00e160r3p8\) < 10.1.0.160\(c01e160r2p8\) `cpe:2.3:o:huawei:mate_20_firmware::::::::`
huawei	mate_20_x_firmware	< 10.1.0.160\(c00e160r2p8\) < 10.1.0.160\(c01e160r2p8\) `cpe:2.3:o:huawei:mate_20_x_firmware::::::::`
huawei	p30_pro_firmware	< 10.1.0.160\(c00e160r2p8\) `cpe:2.3:o:huawei:p30_pro_firmware::::::::`
huawei	laya-al00ep_firmware	< 10.1.0.160\(c786e160r3p8\) `cpe:2.3:o:huawei:laya-al00ep_firmware::::::::`
huawei	tony-al00b_firmware	< 10.1.0.160\(c00e160r2p11\) `cpe:2.3:o:huawei:tony-al00b_firmware::::::::`
huawei	tony-tl00b_firmware	< 10.1.0.160\(c01e160r2p11\) `cpe:2.3:o:huawei:tony-tl00b_firmware::::::::`

Original advisory text

There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker n...

There is an information disclosure vulnerability in several smartphones. The device does not sufficiently validate the identity of smart wearable device in certain specific scenario, the attacker need to gain certain information in the victim's smartphone to launch the attack, and successful exploit could cause information disclosure.Affected product versions include:HUAWEI Mate 20 versions earlier than 10.1.0.160(C00E160R3P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI Mate 20 X versions earlier than 10.1.0.160(C00E160R2P8),versions earlier than 10.1.0.160(C01E160R2P8);HUAWEI P30 Pro versions earlier than 10.1.0.160(C00E160R2P8);Laya-AL00EP versions earlier than 10.1.0.160(C786E160R3P8);Tony-AL00B versions earlier than 10.1.0.160(C00E160R2P11);Tony-TL00B versions earlier than 10.1.0.160(C01E160R2P11).

References

https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200930-01-dos-en Vendor Advisory