CVE-2019-15349 in Camon
Summary
by MITRE
The Tecno Camon Android device with a build fingerprint of TECNO/H612/TECNO-ID5a:8.1.0/O11019/F-180828V106:user/release-keys contains a pre-installed platform app with a package name of com.lovelyfont.defcontainer (versionCode=7, versionName=7.0.11). This app contains an exported service named com.lovelyfont.manager.service.FunctionService that allows any app co-located on the device to supply the file path to a Dalvik Executable (DEX) file which it will dynamically load within its own process and execute in with its own system privileges. This app cannot be disabled by the user and the attack can be performed by a zero-permission app. Executing commands as the system user can allow a third-party app to video record the user's screen, factory reset the device, obtain the user's notifications, read the logcat logs, inject events in the Graphical User Interface (GUI), and obtains the user's text messages, and more. Executing code as the system user can allow a third-party app to factory reset the device, obtain the user's Wi-Fi passwords, obtain the user's notifications, read the logcat logs, inject events in the GUI, change the default Input Method Editor (IME) (e.g., keyboard) with one contained within the attacking app that contains keylogging functionality, and obtains the user's text messages, and more.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/14/2024
This vulnerability exists in the Tecno Camon Android device running Android 8.1.0 with build fingerprint TECNO/H612/TECNO-ID5a. The issue stems from a pre-installed platform application named com.lovelyfont.defcontainer version 7.0.11 which contains an exported service called FunctionService. This service exposes a critical security flaw that allows any application co-located on the device to provide a file path to a Dalvik Executable (DEX) file for dynamic loading and execution within the service's own process with system privileges. The vulnerability is particularly concerning because the application cannot be disabled by users, making it a persistent threat that exists regardless of user configuration choices.
The technical flaw represents a classic privilege escalation vulnerability that maps to CWE-276, specifically improper privileges on resources. The exported service function operates without proper authentication or authorization checks, allowing any app with access to the device to leverage this functionality. This creates a dangerous attack surface where a zero-permission app can execute arbitrary code with system-level privileges through the FunctionService. The service essentially acts as a code execution gateway that bypasses normal Android security boundaries and privilege separation mechanisms, enabling malicious actors to perform operations that should be restricted to system-level processes.
The operational impact of this vulnerability is severe and encompasses multiple attack vectors that align with various techniques described in the MITRE ATT&CK framework. An attacker with access to this vulnerability can execute commands as the system user, enabling capabilities such as screen recording, factory resetting the device, accessing user notifications, reading logcat logs, injecting GUI events, and obtaining text messages. Additionally, the threat model extends to more sophisticated attacks including obtaining Wi-Fi passwords, changing the default Input Method Editor to one containing keylogging functionality, and potentially accessing sensitive user data. These capabilities represent a comprehensive compromise of device security and user privacy, as they allow for persistent monitoring, data exfiltration, and system manipulation.
The vulnerability represents a significant risk to Android device security and aligns with several ATT&CK techniques including privilege escalation, persistence, and credential access. The fact that this vulnerability exists in a pre-installed system application that cannot be disabled creates a particularly dangerous scenario where users have no control over the security posture of their device. The attack surface is expanded by the zero-permission requirement, meaning any app installed on the device can potentially exploit this vulnerability without needing special permissions or user interaction. This makes the threat particularly insidious as it can be exploited through seemingly benign applications that users might install without considering the underlying security implications. Organizations and users should be aware that this vulnerability affects the fundamental security model of the Android operating system and requires immediate attention through firmware updates or device replacement. The vulnerability demonstrates the critical importance of proper privilege management in system applications and the need for comprehensive security reviews of pre-installed applications that may expose dangerous functionality to the broader application ecosystem.