PT-2018-12868 · Google+1 · Android+1

Published 2018-12-28 · Updated 2019-02-07 · CVE-2018-15001

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Vivo V7 Android device with a build fingerprint of vivo/1718/1718:7.1.2/N2G47H/compil11021857:user/release-keys

Description The issue allows any app co-located on the device to initiate the writing of the logcat log, bluetooth log, and kernel log to external storage through the com.vivo.bsptest.BSPTestActivity component. When logging is enabled, a notification appears in the status bar. Although the user can cancel the logging, it can be re-enabled since the app with the package name com.vivo.bsptest cannot be disabled. An app co-located on the device can initiate the writing of these logs, but it requires the READ EXTERNAL STORAGE permission to access the log files.

Recommendations For the Vivo V7 Android device with the specified build fingerprint, consider disabling the com.vivo.bsptest.BSPTestActivity component as a temporary workaround to prevent unauthorized log writing. Restrict access to the external storage to minimize the risk of log file exploitation. Avoid using the com.vivo.bsptest app until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2018-15001

Affected Products

Android

Vivo V7

References · 4

• 🔥 https://kryptowire.com/portal/wp-content/uploads/2018/12/DEFCON-26-Johnson-and-Stavrou-Vulnerable-Out-of-the-Box-An-Eval-of-Android-Carrier-Devices-WP-Updated.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15001 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15001 · Vendor Advisory
• https://kryptowire.com/portal/android-firmware-defcon-2018 · Note