Technical impact
In PhoneInterfaceManager.java, a logic error in the setAllowedCarriers method allows disabling carrier restrictions without requiring elevated privileges or user interaction. The flaw enables a local attacker to elevate privileges, potentially attaining root or system access, which can compromise confidentiality, integrity, and availability by permitting malicious code installation or system tampering.
Affected Systems
The vulnerability affects Google's Android operating system within the PhoneInterfaceManager component. While specific versions are not listed, the bug exists in devices that run the carrier restriction logic, including recent Android releases. Any device containing this unpatched code is susceptible.
Risk and Exploitability
With a CVSS score of 10, the vulnerability is critical, but the EPSS score of less than 1% indicates a very low probability of exploitation at present. It is not listed in CISA's KEV catalog. The attack vector is local privilege escalation that requires no user interaction, meaning an attacker with local code execution or physical access can exploit the issue immediately.
