Coolpad Canvas com.qualcomm.qti.modemtestmode log file

Summaryinfo

A vulnerability has been found in Coolpad Canvas and classified as critical. Affected by this issue is some unknown functionality of the component com.qualcomm.qti.modemtestmode. Performing a manipulation results in log file. This vulnerability is identified as CVE-2018-15004. The attack is only possible with local access. There is not any exploit available.

Detailsinfo

A vulnerability was found in Coolpad Canvas (the affected version unknown). It has been classified as critical. This affects an unknown part of the component com.qualcomm.qti.modemtestmode. The manipulation with an unknown input leads to a log file vulnerability. CWE is classifying the issue as CWE-532. Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

The Coolpad Canvas device with a build fingerprint of Coolpad/cp3636a/cp3636a:7.0/NRD90M/093031423:user/release-keys contains a platform app with a package name of com.qualcomm.qti.modemtestmode (versionCode=24, versionName=7.0) that contains an exported service app component named com.qualcomm.qti.modemtestmode.MbnTestService that allows any app on the device to set certain system properties as the com.android.phone user. When an app sets the persist.service.logr.enable system property to a value of 1, an app with a package name of com.yulong.logredirect (versionCode=20160622, versionName=5.25_20160622_01) will start writing the system-wide logcat log, kernel log, and a tcpdump network traffic capture to external storage. Furthermore, on the Coolpad Canvas device, the com.android.phone app writes the destination phone number and body of the text message for outgoing text messages. A notification when logging can be avoided if the log is enabled after device startup and disabled prior to device shutdown by setting the system properties using the exported interface of the com.qualcomm.qti.modemtestmode app. Any app with the READ_EXTERNAL_STORAGE permission can access the log files.

The bug was discovered 08/05/2018. The weakness was released 12/28/2018 (Website). The advisory is shared at kryptowire.com. This vulnerability is uniquely identified as CVE-2018-15004 since 08/05/2018. An attack has to be approached locally. A authentication is necessary for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 145 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-123382, VDB-123383, VDB-123384 and VDB-128470. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Coolpad

Name

• Canvas

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion