Microsoft experts discovered privilege escalation and arbitrary code execution vulnerabilities in a tool from Huawei.
Microsoft researchers discovered privilege escalation and arbitrary code execution vulnerabilities in a tool from Huawei, both flaws were classified as “high severity.”
The experts discovered the flaws because the kernel sensors in Microsoft Defender Advanced Threat Protection (ATP) detected an anomalous behavior associated with a Huawei device management driver.
Further analysis revealed that the Huawei’s PCManager tool pre-installed on MateBook laptops is affected by a vulnerability (CVE-2019-5241) that can be exploited by an attacker for local privilege escalation. An attacker can trigger the flaw by tricking the victims into executing a malicious application.
“We discovered such a driver while investigating an alert raised by Microsoft Defender Advanced Threat Protection’s kernel sensors. We traced the anomalous behavior to a device management driver developed by Huawei. Digging deeper, we found a lapse in the design that led to a vulnerability that could allow local privilege escalation.” reads the security advisory published by Microsoft.
“We reported the vulnerability (assigned to CVE-2019-5241) to Huawei, who responded and cooperated quickly and professionally. On January 9, 2019, Huawei released a fix.”
Microsoft researchers also discovered another flaw in Huawei PCManager, tracked as CVE-2019-5242, that can be exploited for arbitrary code execution.
“Having been able to freely invoke IOCTL handlers of the driver from user-mode, we looked for other capabilities that can be abused. We found one: the driver provided a capability to map any physical page into user-mode with RW permissions.” continues Microsoft.
“Invoking this handler allowed a code running with low privileges to read-write beyond the process boundaries—to other processes or even to kernel space. This, of course, means a full machine compromise.”
To read the original article:
https://securityaffairs.co/wordpress/82893/hacking/huawei-tool-flaws.html