CVE-2023-21149
📋 TL;DR
This vulnerability allows local attackers to activate or deactivate RCS (Rich Communication Services) on Android devices without proper permissions. It enables local privilege escalation without requiring user interaction. Affects Android devices with specific kernel versions.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Attacker gains elevated privileges to control RCS functionality, potentially intercepting or manipulating communication services.
Likely Case
Local attacker disables RCS services, disrupting messaging capabilities on the device.
If Mitigated
Impact limited to RCS service control without broader system compromise if proper isolation exists.
🎯 Exploit Status
Requires local access but no user interaction. Exploitation likely involves crafted intents to the vulnerable receiver.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: June 2023 Android Security Update
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2023-06-01
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install June 2023 security patch. 3. Reboot device after installation.
🔧 Temporary Workarounds
Disable RCS Services
androidTemporarily disable RCS functionality to remove attack surface
Settings > Apps > Messages > Disable RCS features
🧯 If You Can't Patch
- Restrict physical access to devices and implement application allowlisting
- Monitor for unusual RCS service state changes through device management tools
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If before June 2023, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows 'June 5, 2023' or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Unexpected RCS service activation/deactivation events in system logs
- Intents to com.android.shannonrcs without proper permissions
Network Indicators:
- Sudden RCS service unavailability without user action
SIEM Query:
source="android_system" AND (event="RCS_SERVICE_STATE_CHANGE" OR component="ShannonRcsService")