CVE-2017-8150

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-11-22 · updated 2026-06-17
Weakness: CWE-119

Description

The boot loaders of P10 and P10 Plus Huawei mobile phones with software the versions before Victoria-L09AC605B162, the versions before Victoria-L29AC605B162, the versions before Vicky-L29AC605B162 have an arbitrary memory write vulnerability due to the lack of parameter validation. An attacker with the root privilege of an Android system may trick a user into installing a malicious APP. The APP can modify specific data to cause arbitrary memory writing in the next system reboot, causing continuous system reboot or arbitrary code execution.

Affected products

Huawei Technologies Co., Ltd. P10: before victoria-l09ac605b162; before victoria-l29ac605b162 — fixed in victoria-l09ac605b162, victoria-l29ac605b162
Huawei Technologies Co., Ltd. P10 Plus: before vicky-l29ac605b162 — fixed in vicky-l29ac605b162
Huawei P8 Lite Firmware: before ale-l21c113b566 — fixed in ale-l21c113b566
Huawei Technologies Co., Ltd. Huawei P9: before eva-l09c432b391; before eva-l09c576b386; before eva-l09c605b390; before eva-l09c635b387; before eva-l09c636b388; before eva-l19c10b390 — fixed in eva-l09c432b391, eva-l09c576b386, eva-l09c605b390, eva-l09c635b387, eva-l09c636b388, eva-l19c10b390

How to fix

Upgrade to a fixed version: Huawei Technologies Co., Ltd. P10 victoria-l09ac605b162, victoria-l29ac605b162; Huawei Technologies Co., Ltd. P10 Plus vicky-l29ac605b162; Huawei P8 Lite Firmware ale-l21c113b566; Huawei Technologies Co., Ltd. Huawei P9 eva-l09c432b391, eva-l09c576b386, eva-l09c605b390, eva-l09c635b387. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2017-8150 or the next vulnerability affects your stack