CVE-2023-21378
📋 TL;DR
This vulnerability in Android's Telecomm component allows secondary users to silence incoming calls without proper permission checks, enabling local privilege escalation. It affects Android devices running vulnerable versions, requiring no user interaction for exploitation.
💻 Affected Systems
- Android
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker with secondary user access could silence important calls (emergency, security alerts) and potentially combine with other vulnerabilities for further system compromise.
Likely Case
Malicious apps or users could silence calls to bypass security notifications or disrupt communication on shared devices.
If Mitigated
With proper Android security updates, the vulnerability is eliminated and permission checks are enforced.
🎯 Exploit Status
Exploitation requires secondary user access but no special permissions. No user interaction needed once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Android 14 (October 2023 security update)
Vendor Advisory: https://source.android.com/docs/security/bulletin/android-14
Restart Required: Yes
Instructions:
1. Check for Android system updates in Settings > System > System update. 2. Install Android 14 update if available. 3. Restart device after installation. 4. Verify Android version is 14 or later.
🔧 Temporary Workarounds
Disable secondary user profiles
androidRemove or disable secondary user accounts to eliminate attack vector
Settings > System > Multiple users > Remove secondary users
Restrict app permissions
androidReview and restrict MODIFY_PHONE_STATE permissions for non-essential apps
Settings > Apps > [App Name] > Permissions > Phone > Deny
🧯 If You Can't Patch
- Disable multiple user profiles on shared devices
- Monitor for suspicious call silencing patterns and implement device usage policies
🔍 How to Verify
Check if Vulnerable:
Check Android version in Settings > About phone > Android version. If version is below 14, device is vulnerable.Check Version:
adb shell getprop ro.build.version.releaseVerify Fix Applied:
Verify Android version is 14 or later and check that October 2023 security patch is installed in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Unexpected call silencing events in telephony logs
- Permission denial logs for MODIFY_PHONE_STATE from secondary users
Network Indicators:
- None - this is a local exploit
SIEM Query:
source="android_system" AND (event="call_silenced" OR permission="android.permission.MODIFY_PHONE_STATE") AND user_type="secondary"