Security Advisory - UE Measurement Leak Vulnerability in Huawei P8 Phones
- SA No:Huawei-SA-20151029-01-UE
- Initial Release Date: Oct 29, 2015
- Last Release Date: Nov 18, 2015
An information leak vulnerability exists in Huawei P8 Phones. Before sending a specific signal to a base station, the P8 Phone does not check its own security status. An attacker uses a fake base station to construct a specific scenario and obtain the specific signal which includes user equipment (UE) measurements of the signal strengths. (Vulnerability ID: HWPSIRT-2015-07035)
This vulnerability has been assigned Common Vulnerabilities and Exposures (CVE) ID: CVE-2015-8224.
Huawei has released software updates to fix these vulnerabilities. This advisory is available at the following link:http://www.huawei.com/en/security/psirt/security-bulletins/security-advisories/hw-459832.htm
|
Product Name |
Affected Version |
Resolved Product and Version |
|
P8 |
Versions earlier than GRA-CL00C92B210 |
GRA-CL00C92B210 |
|
Versions earlier than GRA-L09C432B200 |
GRA-L09C432B200 |
|
|
Versions earlier than GRA-TL00C01B210 |
GRA-TL00C01B210 |
|
|
Versions earlier than GRA-UL00C00B210 |
GRA-UL00C00B210 |
By exploiting this vulnerability, an attacker can use a fake base station to obtain UE measurements of the signal strengths.
The vulnerability classification has been performed by using the CVSSv2 scoring system (http://www.first.org/cvss/).
Base Score: 2.6 (AV:N/AC:H/Au:N/C:P/I:N/A:N)
Temporal Score: 2.0 (E:F/RL:OF/RC:C)
1. Prerequisite:
The attacker has to obtain information before security activation of the UE is completed.
2. Attacking procedure:
An attacker uses a fake station to construct a scenario and sends the specific signal to the UE. The UE does not check its own security status before replying to this signal, which enables the attacker to receive the reply before security activation of the UE is completed. The reply includes measurements of the signal strengths from the serving cell and neighbor cells.
This vulnerability was reported by Ravishankar Borgaonkar and Altaf Shaik. Huawei PSIRT is not aware of any public announcements or malicious use of the vulnerability described in this advisory.
Huawei express our appreciation for Ravishankar Borgaonkar and Altaf Shaik’s concerns on Huawei products.
For security problems about Huawei products and solutions, please contactPSIRT@huawei.com.
For general problems about Huawei products and solutions, please directly contact Huawei TAC (Huawei Technical Assistance Center) to request the configuration or technical assistance.
2015-11-18 V1.1UPDATED Added CVE ID
2015-10-29 V1.0 INITIALNone
