CVE-2023-38298: High severity Tcl TCL 30Z vulnerability
Various software builds for the following TCL devices (30Z, A3X, 20XE, 10L) leak the device IMEI to a system property that can be accessed by any local app on the device without any permissions or special privileges. Google restricted third-party apps from directly obtaining non-resettable device identifiers in Android 10 and higher, but in these instances they are leaked by a high-privilege process and can be obtained indirectly. The software build fingerprints for each confirmed vulnerable device are as follows: TCL 30Z (TCL/4188R/JettaATT:12/SP1A.210812.016/LV8E:user/release-keys, TCL/T602DL/JettaTF:12/SP1A.210812.016/vU5P:user/release-keys, TCL/T602DL/JettaTF:12/SP1A.210812.016/vU61:user/release-keys, TCL/T602DL/JettaTF:12/SP1A.210812.016/vU66:user/release-keys, TCL/T602DL/JettaTF:12/SP1A.210812.016/vU68:user/release-keys, TCL/T602DL/JettaTF:12/SP1A.210812.016/vU6P:user/release-keys, and TCL/T602DL/JettaTF:12/SP1A.210812.016/vU6X:user/release-keys); TCL A3X (TCL/A600DL/DelhiTF:11/RKQ1.201202.002/vAAZ:user/release-keys, TCL/A600DL/DelhiTF:11/RKQ1.201202.002/vAB3:user/release-keys, TCL/A600DL/DelhiTF:11/RKQ1.201202.002/vAB7:user/release-keys, TCL/A600DL/DelhiTF:11/RKQ1.201202.002/vABA:user/release-keys, TCL/A600DL/DelhiTF:11/RKQ1.201202.002/vABM:user/release-keys, TCL/A600DL/DelhiTF:11/RKQ1.201202.002/vABP:user/release-keys, and TCL/A600DL/DelhiTF:11/RKQ1.201202.002/vABS:user/release-keys); TCL 20XE (TCL/5087ZBO/DohaTMO:11/RP1A.200720.011/PB7I-0:user/release-keys and TCL/5087ZBO/DohaTMO:11/RP1A.200720.011/PB83-0:user/release-keys); and TCL 10L (TCL/T770B/T1LITE:10/QKQ1.200329.002/3CJ0:user/release-keys and TCL/T770B/T1LITE:11/RKQ1.210107.001/8BIC:user/release-keys). This malicious app reads from the "gsm.device.imei0" system property to indirectly obtain the device IMEI.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-38298?
CVE-2023-38298 is classified as a medium severity vulnerability due to the potential exposure of sensitive device information.
How do I fix CVE-2023-38298?
To mitigate CVE-2023-38298, users should update to the latest firmware version provided by TCL for affected devices.
What devices are affected by CVE-2023-38298?
CVE-2023-38298 affects the TCL 30Z, A3X, 20XE, and 10L devices with specific software versions.
What information is leaked due to CVE-2023-38298?
CVE-2023-38298 allows local apps to access the device's IMEI number without any permissions or special privileges.
Can the IMEI leak from CVE-2023-38298 be exploited by malware?
Yes, the IMEI leak from CVE-2023-38298 can be exploited by malicious local apps to gather sensitive user information.