CVE-2024-47153

Executive Summary

CVE-2024-47153 is an information leak vulnerability affecting certain Honor products. The vulnerability allows a local attacker with low privileges to access sensitive information from the device. With a CVSS score of 6.2 (Medium), the vulnerability is characterized by a low attack complexity and no user interaction requirement, but it requires local access. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild. No public proof-of-concept (PoC) or exploit code is available at this time. The vendor has not released a patch, and no open-source patch data exists.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It is a firmware-level issue in Honor devices. Supply chain risk is limited to the physical device supply chain and firmware update mechanisms.

CVSS Breakdown & Threat Level

• CVSS Score: 6.2 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Local (L) – The attacker must have physical or local network access to the device.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions are required.
• Privileges Required (PR): Low (L) – The attacker needs basic user-level access.
• User Interaction (UI): None (N) – No user action is required for exploitation.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Sensitive information can be fully disclosed.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The low EPSS score and lack of public exploits reduce immediate risk, but the potential for information leakage (e.g., credentials, personal data) makes it a concern for targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in the firmware of certain Honor devices. It allows a local attacker with low privileges to read sensitive information that should be protected. The exact mechanism is not publicly disclosed, but based on the CWE-200 classification, it likely involves improper access control or insecure storage of data.

Potential Attack Vector:

1. An attacker gains local access to the device (e.g., via a malicious app or physical access).
2. The attacker exploits the vulnerability to read files, memory regions, or system logs containing sensitive data.
3. The leaked information could include user credentials, encryption keys, or personal identifiable information (PII).

Affected Components:

• Honor smartphones, tablets, or IoT devices running specific firmware versions (exact versions unknown).

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is not publicly disclosed. In general, such vulnerabilities are fixed by:

• Implementing proper access controls on sensitive system files.
• Encrypting sensitive data at rest.
• Removing debug logs that expose sensitive information.

Hypothetical Example:

# Vulnerable code (hypothetical)
def get_system_info():
    with open('/proc/sensitive_data', 'r') as f:
        return f.read()

# Patched code (hypothetical)
def get_system_info():
    if not current_user.has_permission('read_sensitive'):
        raise PermissionError("Access denied")
    with open('/proc/sensitive_data', 'r') as f:
        return f.read()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Honor device (firmware version unknown).
• Local access to the device (e.g., via ADB or a malicious app).

Exploitation Steps:

1. Gain local access to the device (e.g., install a malicious app or use ADB).
2. Identify the vulnerable endpoint or file (e.g., via fuzzing or reverse engineering).
3. Read the sensitive information:

   adb shell cat /proc/sensitive_data
   

4. Exfiltrate the data.

Note: No public exploit code is available. The above is a generic example.

Blue Team

Detection:

• Monitor for unusual file reads from sensitive system paths.
• Use endpoint detection and response (EDR) to detect unauthorized access to protected files.
• Implement application whitelisting to prevent malicious apps.

Hunting:

• Search for processes reading /proc/ or /sys/ files that are not typically accessed.
• Look for ADB connections from untrusted hosts.

Indicators of Compromise (IOCs)

• File Paths:
  • /proc/sensitive_data (hypothetical)
  • /data/system/device_policies.xml (example)
• Process Names:
  • com.malicious.app
• Network Connections:
  • Outbound connections to unknown IPs from the device.
• Log Entries:
  • Repeated access to protected files in system logs.

Detection Engineering

YARA Rule

rule CVE_2024_47153_InfoLeak {
    meta:
        description = "Detects attempts to read sensitive files on Honor devices"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-47153"
    strings:
        $sensitive_path = "/proc/sensitive_data" nocase
        $sensitive_path2 = "/data/system/" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-47153 - Honor Information Leak Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to read sensitive files on Honor devices
author: Valters IT
date: 2025-04-17
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47153
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/cat'
        CommandLine|contains:
            - '/proc/sensitive_data'
            - '/data/system/'
    condition: selection
falsepositives:
    - Legitimate system administration
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-47153 - Honor Information Leak Exfiltration"; flow:to_server,established; content:"|sensitive_data|"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from sensitive networks until a patch is available.
2. Monitor for suspicious activity using the provided detection rules.
3. Restrict local access by disabling ADB when not in use and using strong app permissions.

Long-term Fix:

• Apply firmware updates from Honor when available.
• Implement principle of least privilege on the device.
• Encrypt sensitive data at rest.

Workarounds:

• Use a mobile device management (MDM) solution to enforce security policies.
• Disable unnecessary services and debug interfaces.

Valters IT