Microsoft experts found high severity flaws in Huawei PCManager

Microsoft experts discovered privilege escalation and arbitrary code execution vulnerabilities in a tool from Huawei. Microsoft researchers discovered privilege escalation and arbitrary code execution vulnerabilities in a tool from Huawei, both flaws were classified as “high severity.” The experts discovered the flaws because the kernel sensors in Microsoft Defender Advanced Threat Protection (ATP) detected an […]

March 26, 2019

Microsoft experts discovered privilege escalation and arbitrary code execution vulnerabilities in a tool from Huawei.

Microsoft researchers discovered privilege escalation and arbitrary code execution vulnerabilities in a tool from Huawei, both flaws were classified as “high severity.”

The experts discovered the flaws because the kernel sensors in Microsoft Defender Advanced Threat Protection (ATP) detected an anomalous behavior associated with a Huawei device management driver.

Further analysis revealed that the Huawei’s PCManager tool pre-installed on MateBook laptops is affected by a vulnerability (CVE-2019-5241) that can be exploited by an attacker for local privilege escalation. An attacker can trigger the flaw by tricking the victims into executing a malicious application.

“We discovered such a driver while investigating an alert raised by Microsoft Defender Advanced Threat Protection’s kernel sensors. We traced the anomalous behavior to a device management driver developed by Huawei. Digging deeper, we found a lapse in the design that led to a vulnerability that could allow local privilege escalation.” reads the security advisory published by Microsoft.

“We reported the vulnerability (assigned to CVE-2019-5241) to Huawei, who responded and cooperated quickly and professionally. On January 9, 2019, Huawei released a fix.”

Microsoft researchers also discovered another flaw in Huawei PCManager, tracked as CVE-2019-5242, that can be exploited for arbitrary code execution.

“Having been able to freely invoke IOCTL handlers of the driver from user-mode, we looked for other capabilities that can be abused. We found one: the driver provided a capability to map any physical page into user-mode with RW permissions.” continues Microsoft.

“Invoking this handler allowed a code running with low privileges to read-write beyond the process boundaries—to other processes or even to kernel space. This, of course, means a full machine compromise.”

The two vulnerabilities were disclosed in February at Microsoft’s Blue Hat conference in Israel.

The Chinese telecommunication giant addressed both vulnerabilities in January.

“The two vulnerabilities we discovered in a driver prove the importance of designing software and products with security in mind. Security boundaries must be honored. Attack surface should be minimized as much as possible. In this case, the flaws could have been prevented if certain precautions were taken,” concludes Microsoft.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – Huawei, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]