CVE-2023-40113 Overview
CVE-2023-40113 is a local information disclosure vulnerability in Google Android's TelephonyProvider component. The flaw stems from a missing permission check in multiple code locations that handle message data. An application running on a multi-user Android device can read SMS and message data belonging to other users on the same device. Exploitation requires only local access and low-privilege application context, with no user interaction needed. The vulnerability affects Android versions 11.0, 12.0, 12.1, and 13.0. Google addressed the issue in the November 2023 Android Security Bulletin.
Critical Impact
A local application can bypass user isolation boundaries and read cross-user message data, exposing private SMS content and metadata without requiring user interaction.
Affected Products
- Google Android 11.0
- Google Android 12.0 and 12.1
- Google Android 13.0
Discovery Timeline
- 2024-02-15 - CVE-2023-40113 published to the National Vulnerability Database (NVD)
- 2023-11-01 - Google releases fix in the Android Security Bulletin for November 2023
- 2024-12-13 - Last updated in NVD database
Technical Details for CVE-2023-40113
Vulnerability Analysis
The vulnerability resides in Android's TelephonyProvider, a content provider responsible for storing telephony-related data including SMS and MMS messages. Multiple code paths within the provider fail to enforce a permission check that confirms whether the calling application has authorization to access message data belonging to a different user profile. Android supports multiple users and work profiles, and the platform relies on permission checks at content provider boundaries to enforce cross-user isolation. When these checks are missing, an installed application can query telephony URIs and receive message records that should remain isolated to another user context. The issue is classified under [CWE-862: Missing Authorization].
Root Cause
The root cause is a missing authorization enforcement in TelephonyProvider query handlers. Code paths that should validate the caller's user identity against the requested data scope omitted the permission verification, allowing requests originating from one user to return rows associated with other users on the device.
Attack Vector
Exploitation requires a local application installed on a multi-user Android device. The malicious application queries telephony content URIs and receives message data from other users without triggering any prompt or interaction. The attack vector is local, requires low privileges, and does not need user interaction. The patch referenced in the upstream commit 64ca6ba981745875dbf2064e0b2a47f8194c4f0a adds the missing permission enforcement to the affected code paths. See the Android TelephonyProvider Update for the upstream fix.
Detection Methods for CVE-2023-40113
Indicators of Compromise
- Installed applications that query telephony content URIs such as content://sms or content://mms without declaring READ_SMS permission in their manifest.
- Unexpected access patterns from non-default messaging applications to TelephonyProvider data stores.
- Devices running affected Android versions (11.0 through 13.0) without the November 2023 security patch level.
Detection Strategies
- Audit installed application permissions and flag applications that interact with telephony content providers outside expected use cases.
- Inspect Android device security patch levels using getprop ro.build.version.security_patch and identify devices reporting a patch level earlier than 2023-11-01.
- Use mobile application analysis tooling to inspect APKs for queries against telephony content URIs combined with multi-user API calls.
Monitoring Recommendations
- Enroll Android devices in a Mobile Device Management (MDM) solution and report on Android Security Patch Level (SPL) compliance.
- Monitor enterprise app stores and sideload telemetry for applications requesting telephony-related permissions or capabilities.
- Track Android Security Bulletin advisories and correlate fleet patch status against newly disclosed telephony CVEs.
How to Mitigate CVE-2023-40113
Immediate Actions Required
- Apply the November 2023 Android security patch level (2023-11-01) or later to all affected devices.
- Inventory Android devices in the fleet and prioritize patching of devices configured with multiple users or work profiles.
- Restrict installation of untrusted applications, particularly on shared and multi-user devices.
Patch Information
Google published the fix in the Android Security Bulletin November 2023. The upstream change in the TelephonyProvider package introduces the missing permission check; review the TelephonyProvider commit for implementation detail. Device manufacturers distribute the fix through their respective monthly security update channels.
Workarounds
- Avoid configuring multiple users or work profiles on devices that cannot receive the November 2023 patch.
- Limit application installation on affected devices to vetted sources such as managed enterprise catalogs.
- Where feasible, replace end-of-life devices that no longer receive Android security updates.
# Verify the Android Security Patch Level on a device via adb
adb shell getprop ro.build.version.security_patch
# Expected output for a patched device: 2023-11-01 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
