Telegram Android Flaw Allowed Remote Code Execution via Voice Calls

Vulnerability Details

Security startup NebuSec identified a flaw in Telegram for Android that could enable remote code execution. The vulnerability was present in versions 8.6.2 to 12.10.3 of the application. An attacker with a standard Telegram account could exploit this flaw by initiating a voice call that the victim answered.

Attack Chain and Impact

According to NebuSec, this flaw could be combined with an information-leak bug to escape the Telegram app's sandbox into the Android operating system. Further chaining with an Android root exploit would grant an attacker full control over the victim's phone, including access to messages, microphone, and camera. NebuSec has no evidence of this flaw being exploited in real-world attacks.

Technical Explanation

The flaw resided in the code responsible for processing 'MediaState' messages, which are exchanged during Telegram calls to report microphone status, camera state, and video rotation. The code failed to correctly handle missing fields in these messages, leading to unauthorized memory access. The Hacker News confirmed this vulnerability by reviewing Telegram's published source code for version 12.10.3.

Resolution and User Action

Telegram addressed the vulnerability in version 12.10.4 of its Android application, released in late September. Users are advised to update their Telegram for Android app to version 12.10.4 or later to mitigate the risk. The flaw could also be blocked by setting Telegram's call privacy option to 'Nobody' or by declining incoming calls.

Disclosure and Recognition

NebuSec reported the flaw to Telegram on September 26, after the fix had already been released. Telegram acknowledged the report but did not assign a CVE identifier or issue a bug bounty, as it initially did not believe the flaw could lead to remote code execution.