CVE-2025-20665
📋 TL;DR
This CVE describes an information disclosure vulnerability in devinfo on MediaTek devices where missing SELinux policies allow unauthorized access to device identifiers. Any local user or app can exploit this without privileges or user interaction. Affects MediaTek-based Android devices with vulnerable devinfo implementations.
💻 Affected Systems
- MediaTek chipset-based Android devices
📦 What is this software?
Android by Google
Android by Google
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Persistent device fingerprinting allowing tracking across apps/services, potential correlation of user activities, and exposure of unique device identifiers to malicious local apps.
Likely Case
Local apps harvesting device identifiers for analytics/tracking without proper permissions, potentially violating privacy regulations.
If Mitigated
Limited impact with proper app sandboxing and SELinux enforcement, though identifiers remain accessible to any local process.
🎯 Exploit Status
Simple local read operation; no authentication or special privileges required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware with patch ID ALPS09555228
Vendor Advisory: https://corp.mediatek.com/product-security-bulletin/May-2025
Restart Required: Yes
Instructions:
1. Check with device manufacturer for firmware updates. 2. Apply MediaTek firmware update containing patch ALPS09555228. 3. Reboot device after update.
🔧 Temporary Workarounds
SELinux Policy Enforcement
linuxManually add SELinux policy to restrict devinfo access
Requires custom SELinux policy modification; consult device manufacturer for specific policy rules
🧯 If You Can't Patch
- Restrict installation of untrusted apps to reduce local attack surface
- Monitor for suspicious local process behavior accessing device identifiers
🔍 How to Verify
Check if Vulnerable:
Check if devinfo is accessible without SELinux denials in audit logs when accessed by unprivileged processesCheck Version:
Check firmware version via 'getprop ro.build.fingerprint' and compare with patched versions from manufacturerVerify Fix Applied:
Verify SELinux policy now denies unauthorized devinfo access attempts in audit logs📡 Detection & Monitoring
Log Indicators:
- SELinux audit denials for devinfo access before patch
- Multiple processes accessing /proc/devinfo or similar paths
Network Indicators:
- None - purely local exploitation
SIEM Query:
source="android_audit" AND "avc: denied" AND "devinfo"