CVE-2023-35665
📋 TL;DR
This vulnerability allows unauthorized import of contacts from other users on Android devices due to a missing permission check in Telephony services. It enables local privilege escalation without requiring user interaction or additional execution privileges. Affects Android devices running vulnerable versions of the Telephony package.
💻 Affected Systems
- Android Telephony services
📦 What is this software?
Android by Google
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker with local access could import sensitive contact data from other users, potentially accessing private information, phone numbers, and contact details without authorization.
Likely Case
Malicious apps could silently harvest contact information from other users on the same device, violating privacy and potentially enabling further attacks.
If Mitigated
With proper patching, the permission check is enforced, preventing unauthorized contact imports and maintaining proper user isolation.
🎯 Exploit Status
Exploitation requires local access to the device but no user interaction. The missing permission check makes exploitation straightforward for attackers with local access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: September 2023 Android Security Patch
Vendor Advisory: https://source.android.com/security/bulletin/2023-09-01
Restart Required: Yes
Instructions:
1. Apply September 2023 Android Security Patch. 2. Update affected Android devices through system updates. 3. Restart device after update installation.
🔧 Temporary Workarounds
Disable contact sharing permissions
androidRestrict contact access permissions for apps to limit potential data exposure
Use single-user mode
androidAvoid using multi-user profiles on affected devices to prevent cross-user contact access
🧯 If You Can't Patch
- Isolate affected devices from sensitive networks and data
- Implement strict app permission controls and monitor for unusual contact access patterns
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If patch level is before September 2023, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify Android security patch level shows September 2023 or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Unusual contact import activities in Telephony service logs
- Permission denial errors related to contact access
Network Indicators:
- None - this is a local vulnerability
SIEM Query:
Search for Telephony service errors or contact import activities outside normal user patterns🔗 References
- https://android.googlesource.com/platform/packages/services/Telephony/+/674039e70e1c5bf29b808899ac80c709acc82290
- https://source.android.com/security/bulletin/2023-09-01
- https://android.googlesource.com/platform/packages/services/Telephony/+/674039e70e1c5bf29b808899ac80c709acc82290
- https://source.android.com/security/bulletin/2023-09-01
