CVE-2022-23835
📋 TL;DR
This vulnerability in Android's Visual Voice Mail (VVM) application allows attackers with temporary control of an app having READ_SMS permission to steal IMAP credentials from SMS messages. These credentials can then be used to access voice mail messages, including historical ones. Android users with VVM applications through February 24, 2022 are affected.
💻 Affected Systems
- Android Visual Voice Mail (VVM) application
📦 What is this software?
Visual Voice Mail by Visual Voice Mail Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain persistent access to voice mail accounts, potentially accessing sensitive voice messages including authentication codes, business communications, and personal information.
Likely Case
Targeted attacks against specific individuals to intercept voice mail messages, potentially for identity theft or corporate espionage.
If Mitigated
Limited impact if SMS permissions are properly restricted and VVM applications are updated or disabled.
🎯 Exploit Status
Requires social engineering or malware to gain READ_SMS permission first
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 2022-02-24
Vendor Advisory: https://www.kb.cert.org/vuls/id/383864
Restart Required: No
Instructions:
1. Update VVM application to latest version 2. Check for Android system updates 3. Verify VVM app version is post-February 2022
🔧 Temporary Workarounds
Disable VVM application
androidRemove or disable the Visual Voice Mail application
adb shell pm disable-user --user 0 com.android.vvm
Restrict SMS permissions
androidReview and remove READ_SMS permission from unnecessary applications
adb shell pm revoke <package_name> android.permission.READ_SMS
🧯 If You Can't Patch
- Implement mobile device management (MDM) to control app permissions
- Monitor for suspicious SMS access patterns and unauthorized credential usage
🔍 How to Verify
Check if Vulnerable:
Check VVM app version date - if before February 2022, likely vulnerableCheck Version:
adb shell dumpsys package com.android.vvm | grep versionNameVerify Fix Applied:
Verify VVM app version is updated to post-February 2022 release📡 Detection & Monitoring
Log Indicators:
- Multiple SMS read operations from non-messaging apps
- Unusual IMAP authentication attempts to voice mail servers
Network Indicators:
- IMAP connections to voice mail servers from unexpected IPs
- SMS forwarding to unknown destinations
SIEM Query:
source="android_logs" AND (event="SMS_READ" AND app NOT IN ("com.android.mms", "com.google.android.apps.messaging"))