Huawei Yale-L21A 10.0.0.168(C461E3R3P1) EMUI10 firmware download

Product name Confidentiality level
YAL-L21 CONFIDENTIAL
Commercial Name Total 8 pages
HONOR 20

HONOR YAL-L21 10.0.0.168(C461E3R3P1)
Software Release Notes

Prepared by YAL Team Date 2019-10-25
Reviewed by YAL Team Date 2019-10-25
Approved by YAL Team Date 2019-10-25

HONOR Technologies Co., Ltd.

All rights reserved

Revision Record

Date Revision version Change Description Author
yyyy-mm-dd 1.0 Release for version V100R001CXXB001 XXX TEAM
yyyy-mm-dd 1.1 Add OTA feature description XXX TEAM
yyyy-mm-dd 2.0 Release for version V100R001CXXB002 XXX TEAM
2018-2-13 2.1 1. Change “Product version” to “Commercial Name”
2. Remove “Main features”
3. Make “Version Description” more clear
4.Change” Improvement in the Previous Version” to “Improvement From the Previous Version”
4.Change “Effect” to “Remarks” MR TEAM
2018-5-18 2.2 Add match EMUI 9.0 template Custom Team
2018-8-8 2.2 1. Delete column “Case ID”
2. Change “Issue Description” to “Feature Description” in New Features MR TEAM
2019-1-1 2.3 1. Add “IMEI SV” in Version Description. MR TEAM
2019-3-12 2.3.1 1. Update Version Description. I&M

Table of Contents
1 Version Description 4
2 New Features 4
3 Improvement from the Previous Version 4
4 Known Limitations and Issues 5
5 Software Vulnerabilities Fixes 5

YAL-L21 10.0.0.168(C461E3R3P1) Software Release Notes
Version Description

Model YAL-L21
Build number 10.0.0.168(C461E3R3P1)
Previous released number 9.1.0.162(C461E2R3P1)
IMEI SV 11
Android version 10
Magic UI version 3.0.0
CPU Huawei Kirin 980
Android security patch 6 October 2019
Baseband version 21C20B376S000C000; 21C20B376S000C000
Kernel Version 4.14.116
android@localhost #1
Thu Oct 24 17:23:05 CST 2019
Version Type TA

New Features

Index Feature Description
1 Magic UI 3.0 is designed to further streamline and enhance the quality of your user experience. It provides users with a whole new, fine-tuned user interface designed to facilitate a smoother and more intuitive user experience. Enhanced data and privacy protection also brings you a more secure experience
2 Magazine Design Incorporates a magazine-style layout, for a more comfortable and authentic reading experience. · Morandi Color Understated gray tones make for a gentler and more comfortable display · Animations Dynamic, naturally-based animations for page transitions, app launches, and other scenarios
3 GPU Turbo Improves the smoothness and stability of the system when playing games. · Phone Clone Improves the connection and cloning speed
4 AppAssistant dropzone Adds a dropzone for AppAssistant, allowing you to quickly access services such as game acceleration and do-not-disturb



Improvement from the Previous Version

Index Issue Description
1 NA
2 NA
Known Limitations and Issues

Index Issue Description Remarks
1 NA
Software Vulnerabilities Fixes

Software/Module name Version CVE ID Vulnerability Description Impact Description
Platform 9 CVE-2019-2110 In ScreenRotationAnimation of ScreenRotationAnimation.java, there is a possible capture of a secure screen due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. The fix is designed to correctly mark secure frames during screen rotation.
Qualcomm components NA CVE-2018-11902 undefined
Kernel NA CVE-2019-2215 In binder_thread_release of binder.c, there is possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. The fix is designed to use POLLFREE when the thread exits to clean up the waitqueue.
Platform 10,7.1.1,7.1.2,8.0,8.1,9 CVE-2019-2186 In GetMBheader of combined_decode.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. The fix is designed to add a bounds check.
Platform 10,7.1.1,7.1.2,8.0,8.1,9 CVE-2019-2185 In VlcDequantH263IntraBlock_SH of vlc_dequant.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. The fix is designed to add a bounds check.
Platform 7.1.1,7.1.2,8.0,8.1,9 CVE-2019-2184 In PV_DecodePredictedIntraDC of dec_pred_intra_dc.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. The fix is designed to add a bounds check.
Platform 7.1.1,7.1.2,8.0,8.1,9 CVE-2019-2173 In startActivityMayWait of ActivityStarter.java, there is a possible incorrect Activity launch due to an incorrect permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. The fix is designed to correctly preserve the realCallingUid from the pending intent.
Platform 7.1.1,7.1.2,8.0,8.1,9,10 CVE-2019-2187 In nfc_ncif_decode_rf_params of nfc_ncif.cc, there is a possible out of bounds read due to an integer underflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. The fix is designed to clamp the integer value to an allowed range.
Platform 8.0,8.1,9 CVE-2019-2114 In the default privileges of NFC, there is a possible local bypass of user interaction requirements on package installation due to a default permission. This could lead to local escalation of privilege by installing an application with no additional execution privileges needed. User interaction is needed for exploitation. The fix is designed to remove the default permission.
Kernel component NA CVE-2018-19824 In usb_audio_probe of card.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege when probing for USB audio devices with no additional execution privileges needed. User interaction is not needed for exploitation. The fix is designed to move atomic_dec to prevent the use after free.