« Volver al listado

CVE-2021-41848

Estado: ModificadaAlta (7.8)—

An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It mishandles software updates such that local third-party apps can provide a spoofed software update file that contains an arbitrary shell script and arbitrary ARM binary, where both will be executed as the root user with an SELinux domain named osi. To exploit this vulnerability, a local third-party app needs to have write access to external storage to write the spoofed update at the expected path.

Leer descripción completaMostrar menos

The vulnerable system binary (i.e., /system/bin/osi_bin) does not perform any authentication of the update file beyond ensuring that it is encrypted with an AES key (that is hard-coded in the vulnerable system binary). Processes executing with the osi SELinux domain can programmatically perform the following actions: install apps, grant runtime permissions to apps (including permissions with protection levels of dangerous and development), access extensive Personally Identifiable Information (PII) using the programmatically grant permissions, uninstall apps, set the default launcher app to a malicious launcher app that spoofs other apps, set a network proxy to intercept network traffic, unload kernel modules, set the default keyboard to a keyboard that has keylogging functionality, examine notification contents, send text messages, and more. The spoofed update can optionally contain an arbitrary ARM binary that will be locally stored in internal storage and executed at system startup to achieve persistent code execution as the root user with the osi SELinux domain. This ARM binary will continue to execute at startup even if the app that provided the spoofed update is uninstalled.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Bluproducts — G90 FirmwareBluproducts — G9 FirmwareLuna — Simo FirmwareWikomobile — Tommy 3 FirmwareWikomobile — Tommy 3 Plus Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-41848",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-03-11T23:15:08.840",
  "references": [
    {
      "url": "https://athack.com/session-details/401",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://simowireless.com/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.kryptowire.com/android-firmware-2022/",
      "tags": [
        "Broken Link"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://athack.com/session-details/401",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://simowireless.com/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kryptowire.com/android-firmware-2022/",
      "tags": [
        "Broken Link"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kryptowire.com/blog/vsim-vulnerability-within-simo-android-phones-exposed/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Luna Simo PPR1.180610.011/202001031830. It mishandles software updates such that local third-party apps can provide a spoofed software update file that contains an arbitrary shell script and arbitrary ARM binary, where both will be executed as the root user with an SELinux domain named osi. To exploit this vulnerability, a local third-party app needs to have write access to external storage to write the spoofed update at the expected path. The vulnerable system binary (i.e., /system/bin/osi_bin) does not perform any authentication of the update file beyond ensuring that it is encrypted with an AES key (that is hard-coded in the vulnerable system binary). Processes executing with the osi SELinux domain can programmatically perform the following actions: install apps, grant runtime permissions to apps (including permissions with protection levels of dangerous and development), access extensive Personally Identifiable Information (PII) using the programmatically grant permissions, uninstall apps, set the default launcher app to a malicious launcher app that spoofs other apps, set a network proxy to intercept network traffic, unload kernel modules, set the default keyboard to a keyboard that has keylogging functionality, examine notification contents, send text messages, and more. The spoofed update can optionally contain an arbitrary ARM binary that will be locally stored in internal storage and executed at system startup to achieve persistent code execution as the root user with the osi SELinux domain. This ARM binary will continue to execute at startup even if the app that provided the spoofed update is uninstalled."
    },
    {
      "lang": "es",
      "value": "Se ha detectado un problema en Luna Simo versión PPR1.180610.011/202001031830. Maneja inapropiadamente las actualizaciones de software de tal manera que las aplicaciones locales de terceros pueden proporcionar un archivo de actualización de software falsificado que contenga un script de shell arbitrario y un binario ARM arbitrario, donde ambos serán ejecutados como el usuario root con un dominio SELinux llamado osi. Para explotar esta vulnerabilidad, una aplicación local de terceros necesita tener acceso de escritura al almacenamiento externo para escribir la actualización falsa en la ruta esperada. El binario del sistema vulnerable (es decir, /system/bin/osi_bin) no lleva a cabo ninguna autenticación del archivo de actualización más allá de asegurarse de que está cifrado con una clave AES (que está embebida en el binario del sistema vulnerable). Los procesos que son ejecutados con el dominio osi SELinux pueden llevar a cabo de forma programada las siguientes acciones instalar aplicaciones, conceder permisos de ejecución a las aplicaciones (incluidos los permisos con niveles de protección peligrosos y de desarrollo), acceder a una amplia información de identificación personal (PII) usando los permisos concedidos mediante programación, desinstalar aplicaciones, establecer la aplicación de inicio por defecto a una aplicación de inicio maliciosa que falsifica otras aplicaciones, establecer un proxy de red para interceptar el tráfico de red, descargar módulos del núcleo, establecer el teclado por defecto a un teclado que presenta funcionalidad de registro de teclas, examinar el contenido de las notificaciones, enviar mensajes de texto, y más. La actualización falsa puede contener opcionalmente un binario ARM arbitrario que será almacenado localmente en el almacenamiento interno y será ejecutado al iniciar el sistema para lograr la ejecución persistente de código como usuario root con el dominio osi SELinux. Este binario ARM continuará ejecutándose al iniciar el sistema incluso si la aplicación que proporcionó la actualización falsa es desinstalada"
    }
  ],
  "lastModified": "2026-06-17T04:09:00.833",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bluproducts:g90_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B003884D-03B5-4E27-A506-22A36E0334A2"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bluproducts:g90:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8E152DA2-58DC-499B-AD5C-C54B6F7F9EA6"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:bluproducts:g9_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA87E8FB-2312-4C36-8E99-9FC13249FF96"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:bluproducts:g9:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "84252BD6-08BF-4591-BB70-159AEC3F5526"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wikomobile:tommy_3_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0998AB21-51AF-44F1-AB64-DAA2F6994255"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wikomobile:tommy_3:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6DFAA033-25DC-4C58-862A-DB52E38053E5"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wikomobile:tommy_3_plus_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0D3D7AB-AABF-4BDA-88C8-6BA9A7D683C1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wikomobile:tommy_3_plus:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "AF14B073-3785-4B54-96F2-DE5C8AD50019"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:luna:simo_firmware:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57816BEB-1BBE-489D-B6B0-BA24E21D6F7D"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:luna:simo:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0AD9D06F-E7A7-4453-813D-B7A3FD544F1A"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}