😍
quoting🚨 Zero-click “SMS of Death” flaw can crash Android phone services
nevent1q…y8lt
A researcher has disclosed an unpatched Android vulnerability that allows a malformed WAP Push SMS to silently crash the com.android.phone process, dropping active calls and temporarily disabling cellular service without any interaction from the victim.
The message does not appear in the inbox, and carrier redelivery can repeatedly trigger the crash. The researcher also found that sending multiple messages rapidly could corrupt the SMS dataset, leaving telephony services crashing after every reboot.
⠀
• CVE: None assigned
• Attack vector: Remote WAP Push SMS
• User interaction: None
• Impact: Denial of service, dropped calls and possible persistent loss of telephony
• Tested: Pixel 9 and multiple Samsung Galaxy and A-series devices
• Patch status: None available
• Vendor status: “Won’t Fix” and classified as a non-security issue, according to the disclosure
⠀
The researcher reported the flaw to Google in May and publicly disclosed it on October 29 after the report and subsequent appeals were rejected.
There is currently no evidence that the vulnerability is being exploited in the wild.
Source: https://smsofdeath.com/
