Product name Confidentiality level
AQM-LX1 CONFIDENTIAL
Commercial Name
Total 10 pages
HUAWEI Y8p
XXX Software Release Notes Vx.y
Prepared by AQM Team Date 2020-4-23
Reviewed by AQM Team Date 2020-4-23
Approved by AQM Team Date 2020-4-23
Huawei Technologies Co., Ltd.
All rights reserved
Revision Record
Date Revision Change Description Author
version
yyyy-mm-dd 1.0 Release for version V100R001CXXB001 XXX TEAM
yyyy-mm-dd 1.1 Add OTA feature description XXX TEAM
yyyy-mm-dd 2.0 Release for version V100R001CXXB002 XXX TEAM
1. Change “Product version” to “Commercial Name”
2. Remove “Main features”
3. Make “Version Description” more clear
2018-2-13 2.1 4.Change” Improvement in the Previous Version” to
MR TEAM
“Improvement From the Previous Version”
4.Change “Effect” to “Remarks”
2018-5-18 2.2 Add match EMUI 9.0 template Custom Team
1. Delete column “Case ID”
2018-8-8 2.2 2. Change “Issue Description” to “Feature MR TEAM
Description” in New Features
2019-1-1 2.3 1. Add “IMEI SV” in Version Description. MR TEAM
2019-3-12 2.3.1 1. Update Version Description. I&M
2019-5-17 2.3.2 1. Add “Android security patch” I&M
Table of Contents
1 Version Description..................................................................................................................4
2 New Features..........................................................................................................................4
3 Improvement from the Previous Version.................................................................................4
4 Known Limitations and Issues.................................................................................................4
5 Software Vulnerabilities Fixes..................................................................................................5
XXX Software Release Notes CONFIDENTIAL
Vx.y
XXX Software Release Notes Vx.y
1 Version Description
Model AQM-LX1
10.1.0.109(C605E1R5P1)
Build number
GPU Turbo
Previous released number NA
IMEI SV 02
Android version 10
EMUI version 10.1.0
CPU Huawei Kirin 710F
Android security patch 1 April 2020
Baseband version 21C20B388S000C000,21C20B388S000C000
4.14.116
Kernel Version android@localhost #1
Tue Apr 21 19:05:29 CST 2020
Version Type TA
2 New Features
Index Feature Description
Integrates Google security patches released in April 2020 for improved
1
system security.
3 Improvement from the Previous Version
Index Issue Description
1 NA
4 Known Limitations and Issues
Index Issue Description Remarks
1 NA NA
5 Software Vulnerabilities Fixes
Vulnerabilities information is available through CVE IDs in NVD (National Vulnerability Database) website:
http://web.nvd.nist.gov/view/vuln/search
#4 Google Security Patch：April.2020
Page 4
XXX Software Release Notes CONFIDENTIAL
Software/
Module
Version CVE
ID
Vx.y
Vulnerability Description Impact
Description
name
Platform 9,10 CVE- In decrypt_1_2 of CryptoPlugin.cpp, there is a The fix is
202 possible out of bounds write due to stale pointer. designed to fix
0- This could lead to local escalation of privilege with the base pointer
007 no additional execution privileges needed. User used to set the
9 interaction is not needed for exploitation. destination.
Platform 9,10 CVE- In releaseSecureStops of DrmPlugin.cpp, there is a The fix is
202 possible out of bounds write due to a missing designed to add
0- bounds check. This could lead to local escalation of the missing
007 privilege with no additional execution privileges bounds check.
8 needed. User interaction is not needed for
exploitation.
Qualcomm NA CVE- undefined
components 201
9-
140
87
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
75
FPC NA CVE- In authorize_enroll of the FPC IRIS TrustZone app, The fix is
components 202 there is a possible out of bounds read due to a designed to add
0- missing bounds check. This could lead to local bounds checks.
007 information disclosure with System execution
7 privileges needed. User interaction is not needed
for exploitation.
FPC NA CVE- In get_auth_result of the FPC IRIS TrustZone app, The fix is
components 202 there is a possible out of bounds write due to a designed to add
0- missing bounds check. This could lead to local bounds checks.
007 escalation of privilege with System execution
6 privileges needed. User interaction is not needed
for exploitation.
FPC NA CVE- In set_shared_key of the FPC IRIS TrustZone app, The fix is
components 202 there is a possible out of bounds read due to a designed to add
0- missing bounds check. This could lead to local bounds checks.
007 information disclosure with System execution
5 privileges needed. User interaction is not needed
for exploitation.
Page 5
XXX Software Release Notes CONFIDENTIAL
Platform 8.0,8.1,9
,10
CVE-
202
In Vx.y verifyIntentFiltersIfNeeded
PackageManagerService.java, there is a possible
of The
designed
fix is
to
0- settings bypass allowing an app to become the revoke 'always'
007 default handler for arbitrary domains. This could web handler
4 lead to local escalation of privilege with User status when app
execution privileges needed. User interaction is no longer uses
not needed for exploitation. autoVerify.
Kernel NA CVE- In ml_ff_destroy of ff-memless.c, there is possible The fix is
201 memory corruption due to a use after free. This designed to clean
9- could lead to local escalation of privilege if a up an effect
195 malicious USB device is used, with no additional timer.
24 execution privileges needed. User interaction is
not needed for exploitation.
Kernel NA CVE- In many initialization functions of many drivers in The fix is
201 drivers/hid, there are possible out of bounds designed to
9- writes due to a missing check for an empty list. check if the
195 These could lead to local escalation of privilege if driver's input lists
32 using a malicious USB driver, with no additional are empty before
execution privileges needed. User interaction is using them.
not needed for exploitation.
Kernel NA CVE- In snd_timer_open of timer.c, there is a possible The fix is
201 code execution due to a use after free. This could designed to not
9- lead to local escalation of privilege with no re-use variables
198 additional execution privileges needed. User for temporary
07 interaction is not needed for exploitation. checks.
Qualcomm NA CVE- undefined
components 201
9-
140
70
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 141
12
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 141
14
Qualcomm NA CVE- undefined
components 201
9-
141
22
Page 6
XXX Software Release Notes CONFIDENTIAL
Qualcomm
closed-
NA CVE-
201
Vx.y undefined
source 9-
components 141
34
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 141
11
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 141
13
Qualcomm NA CVE- undefined
components 201
9-
141
31
Qualcomm NA CVE- undefined
components 201
9-
141
04
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 141
27
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 141
35
Qualcomm NA CVE- undefined
components 201
9-
141
32
Page 7
XXX Software Release Notes CONFIDENTIAL
Qualcomm
closed-
NA CVE-
201
Vx.y undefined
source 9-
components 141
05
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 141
10
Platform 8.0,8.1,9 CVE- In rw_t2t_handle_tlv_detect_rsp of The fix is
,10 202 rw_t2t_ndef.cc, there is a possible out of bounds designed to add
0- write due to a missing bounds check. This could the missing
007 lead to remote code execution over NFC with no bounds check.
3 additional execution privileges needed. User
interaction is not needed for exploitation.
Platform 8.0,8.1,9 CVE- In rw_t2t_handle_tlv_detect_rsp of The fix is
,10 202 rw_t2t_ndef.cc, there is a possible out of bounds designed to add
0- write due to a missing bounds check. This could the missing
007 lead to remote code execution over NFC with no bounds check.
2 additional execution privileges needed. User
interaction is not needed for exploitation.
Platform 8.0,8.1,9 CVE- In rw_t2t_extract_default_locks_info of The fix is
,10 202 rw_t2t_ndef.cc, there is a possible out of bounds designed to add
0- write due to a missing bounds check. This could the missing
007 lead to remote code execution over NFC with no bounds check.
1 additional execution privileges needed. User
interaction is not needed for exploitation.
Platform 8.0,8.1,9 CVE- In rw_t2t_update_lock_attributes of The fix is
,10 202 rw_t2t_ndef.cc, there is a possible out of bounds designed to add
0- write due to a missing bounds check. This could the missing
007 lead to remote code execution over NFC with no bounds check.
0 additional execution privileges needed. User
interaction is not needed for exploitation.
Qualcomm NA CVE- undefined
closed- 202
source 0-
components 365
1
Qualcomm NA CVE- undefined
components 202
0-
365
1
Page 8
XXX Software Release Notes CONFIDENTIAL
MediaTek
components
NA CVE-
202
Vx.y
In mnld, there is a possible information disclosure
due to an exposed network socket. This could lead
The
designed
fix is
to
0- to remote information disclosure of the user's remove
009 location with no additional execution privileges externally
1 needed. User interaction is not needed for accessible
exploitation. sockets.
MediaTek NA CVE- In The fix is
components 202 com.mediatek.email.backuprestore.EmailBackupR designed to
0- estoreReceiver, there is a possible disclosure of remove the Email
009 emails due to a missing permission check. This Backup feature
0 could lead to local information disclosure with no and related code.
additional execution privileges needed. User
interaction is not needed for exploitation.
MediaTek NA CVE- In The fix is
components 202 com.mediatek.apst.target.receiver.DaemonReceiv designed to
0- er, there is possible access to private user data remove the
006 due to a permissions bypass. This could lead to vulnerable app.
5 remote information disclosure with no additional
execution privileges needed. User interaction is
not needed for exploitation.
MediaTek NA CVE- In the OMACP app, there is a possible disclosure of The fix is
components 202 provisioning data due to a missing permission designed to limit
0- check. This could lead to local information the provisioning
006 disclosure with no additional execution privileges data to access
4 needed. User interaction is not needed for only by
exploitation. preloaded
system apps that
declare the
required
permission.
Platform 8.0,8.1,9 CVE- In lookupName of resolve.c, there is a possible The fix is
,10 201 code execution due to a use after free. This could designed to
9- lead to local escalation of privilege with no ensure that
501 additional execution privileges needed. User aliased window
8 interaction is not needed for exploitation. functions are not
used within
aggregate
functions.
Notes:Android
8.1 - This patch is
provided for
completeness.Pa
rtners on 8.1
with an SPL of
2019-03-01 or
greater are
already patched
and do not need
to re-apply this
fix. Android 9 - To
fully patch
Android 9,
partners should
apply the original
fix and
Page 9
XXX Software Release Notes CONFIDENTIAL
Vx.y supplemental
patch, both of
which are found
in the bulletin zip
file. This resolves
the previously
identified
functional
regression.
Android 8.0, 10 -
This patch did
not cause a
functional
regression and
has not changed
from the
previously
released version.
For partners who
have previously
applied and
retained this
patch there is no
action. For
Partners who
have not
previously
applied the patch
it is required as
part of SPL 2020-
04-01.These
instructions also
apply to CVE-
2019-8457 and
CVE-2019-9936
below.
Platform 10 CVE- In onOpActiveChanged and related methods of The fix is
202 AppOpsControllerImpl.java, there is a possible way designed to
0- to display an app overlaying other apps without prevent sending
008 the notification icon that it's overlaying. This could early termination
0 lead to local escalation of privilege with User of appop use.
execution privileges needed. User interaction is
needed for exploitation.
Platform 8.0,8.1,9 CVE- In finalize of AssetManager.java, there is possible The fix is
,10 202 memory corruption due to a double free. This designed to set
0- could lead to local escalation of privilege with no the pointer to
008 additional execution privileges needed. User zero after
1 interaction is not needed for exploitation. freeing.
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
01
Page 10
XXX Software Release Notes CONFIDENTIAL
Qualcomm
closed-
NA CVE-
201
Vx.y undefined
source 9-
components 105
75
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
19
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
18
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
21
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 105
88
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 105
89
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
09
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
22
Page 11
XXX Software Release Notes CONFIDENTIAL
Qualcomm
closed-
NA CVE-
201
Vx.y undefined
source 9-
components 106
10
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
33
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
20
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 106
08
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 104
83
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 105
51
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
12
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 106
09
Page 12
XXX Software Release Notes CONFIDENTIAL
Qualcomm
closed-
NA CVE-
201
Vx.y undefined
source 9-
components 140
11
Qualcomm NA CVE- undefined
closed- 201
source 9-
components 140
07
Platform 10 CVE- There is a possible disclosure of RAM using a In device
201 shared crypto key due to improperly used crypto. configurations,
9- This could lead to local information disclosure with zram writeback
205 no additional execution privileges needed. User must be disabled.
6 interaction is not needed for exploitation. An example code
snippet can be
found in the zip
file.
Platform 8.0,8.1,9 CVE- In rtreenode of rtree.c, there is a possible out of The fix is
,10 201 bounds read due to a missing bounds check. This designed to
9- could lead to local information disclosure with no replace the fixed-
845 additional execution privileges needed. User size stack buffer
7 interaction is not needed for exploitation. with a
dynamically-
resized string.
Platform 10 CVE- In ExternalVibration of ExternalVibration.java, The fix is
202 there is a possible activation of an arbitrary intent designed to
0- due to unsafe deserialization. This could lead to remove excessive
008 local escalation of privilege to system_server with serialization of
2 no additional execution privileges needed. User Audio Attributes.
interaction is not needed for exploitation.
Platform 8.0,8.1,9 CVE- In fts5HashEntrySort of fts5_hash.c, there is a The fix is
,10 201 possible out of bounds read due to a missing designed to add
9- bounds check. This could lead to local information the missing
993 disclosure with no additional execution privileges bounds check.
6 needed. User interaction is not needed for
exploitation.
Page 13
