PT-2024-12703 · Google+1 · Android 10+4

Published 2024-04-22 · Updated 2024-07-03 · CVE-2023-38298

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions TCL 30Z versions 12/SP1A.210812.016/LV8E through 12/SP1A.210812.016/vU6X TCL A3X versions 11/RKQ1.201202.002/vAAZ through 11/RKQ1.201202.002/vABS TCL 20XE versions 11/RP1A.200720.011/PB7I-0 through 11/RP1A.200720.011/PB83-0 TCL 10L versions 10/QKQ1.200329.002/3CJ0 through 11/RKQ1.210107.001/8BIC

Description The issue concerns various software builds for TCL devices that leak the device IMEI to a system property, allowing any local app to access it without permissions. This occurs due to a high-privilege process leaking the identifier, which can then be obtained indirectly. The malicious app reads from the gsm.device.imei0 system property to obtain the device IMEI. Google restricted direct access to non-resettable device identifiers in Android 10 and higher, but this leak bypasses that restriction.

Recommendations For TCL 30Z versions 12/SP1A.210812.016/LV8E through 12/SP1A.210812.016/vU6X, restrict access to the gsm.device.imei0 system property to prevent indirect obtainment of the device IMEI. For TCL A3X versions 11/RKQ1.201202.002/vAAZ through 11/RKQ1.201202.002/vABS, avoid using the gsm.device.imei0 system property in local apps until the issue is resolved. For TCL 20XE versions 11/RP1A.200720.011/PB7I-0 through 11/RP1A.200720.011/PB83-0, consider disabling access to the gsm.device.imei0 system property as a temporary workaround. For TCL 10L versions 10/QKQ1.200329.002/3CJ0 through 11/RKQ1.210107.001/8BIC, limit the use of the gsm.device.imei0 system property to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Incorrect Privilege Assignment

Weakness Enumeration

CWE-284

CWE-266

CWE-280

Related Identifiers

CVE-2023-38298

Affected Products

Android 10

Tcl 10L

Tcl 20Xe

Tcl 30Z

Tcl A3X

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-38298 · Security Note
• https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf · Note
• https://t.me/cvenotify/77656 · Telegram Post
• https://t.me/cvenotify/77692 · Telegram Post