Back

CVE-2023-38296

April 22, 2024, 7:24 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

TCL A3X

  • TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAAZ:user/release-keys
  • TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB3:user/release-keys
  • TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB7:user/release-keys
  • TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABA:user/release-keys
  • TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABM:user/release-keys
  • TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABP:user/release-keys
  • TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABS:user/release-keys

TCL 30Z

  • TCL/4188R/Jetta_ATT:12/SP1A.210812.016/LV8E:user/release-keys
  • TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU5P:user/release-keys
  • TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU61:user/release-keys
  • TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU66:user/release-keys
  • TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU68:user/release-keys
  • TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6P:user/release-keys
  • TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6X:user/release-keys

Source

cve@mitre.org

Tags

CVE-2023-38296 details

Published : April 22, 2024, 3:15 p.m.
Last Modified : April 22, 2024, 7:24 p.m.

Description

Various software builds for the following TCL 30Z and TCL A3X devices leak the ICCID to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: TCL 30Z (TCL/4188R/Jetta_ATT:12/SP1A.210812.016/LV8E:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU5P:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU61:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU66:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU68:user/release-keys, TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6P:user/release-keys, and TCL/T602DL/Jetta_TF:12/SP1A.210812.016/vU6X:user/release-keys) and TCL A3X (TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAAZ:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB3:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAB7:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABA:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABM:user/release-keys, TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABP:user/release-keys, and TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vABS:user/release-keys). This malicious app reads from the "persist.sys.tctPowerIccid" system property to indirectly obtain the ICCID.

CVSS Score

1 2 3 4 5 6 7 8 9 10

Weakness

Weakness Name Description

References

URL Source
https://media.defcon.org/DEF%20CON%2031/DEF%20CON%2031%20presentations/Ryan%20Johnson%20Mohamed%20Elsabagh%20Angelos%20Stavrou%20-%20Still%20Vulnerable%20Out%20of%20the%20Box%20Revisiting%20the%20Security%20of%20Prepaid%20Android%20Carrier%20Devices.pdf cve@mitre.org
This website uses the NVD API, but is not approved or certified by it.