Information exposure through the emergency dialer in Canonical Unity8 (Ubuntu)

Information Exposure vulnerability in Unity8 as used on the Ubuntu phone and possibly also in Unity8 shipped elsewhere. This allows an attacker to enable the MTP service by opening the emergency dialer. Fixed in 8.11+16.04.20160111.1-0ubuntu1 and 8.11+15.04.20160122-0ubuntu1.

• Canonical Unity8 (Ubuntu): the branch beginning at 8.11 and below 8.11+16.04.20160111.1-0ubuntu1 is marked affected.
• Ubuntu 15.04 branch: 8.11+15.04.20160122-0ubuntu1 is recorded as unaffected and is identified as a separate fix for that branch.
• The description also raises the possibility that Unity8 shipped elsewhere may be affected, but it does not provide version boundaries for those deployments. Do not assume that unverified parallel or later branches are safe.

Canonical Unity8, as used on Ubuntu phones and potentially in other distributions, mishandles access from the emergency dialer to the MTP service. The attacker-controlled action is opening the emergency dialer, which can enable MTP on an affected device. The supplied Canonical attack characteristics indicate that physical access is required, but no prior privileges or authentication are needed, the complexity is low, and no additional victim interaction is required. The weakness is classified as CWE-200, exposure of information to an unauthorized actor. The implementation detail that causes the issue, such as the authorization check, service communication path, or specific data objects reachable through MTP, is not disclosed in the reviewed sources.

Exploitation requires physical access to an affected phone and is not a network-reachable attack. The supplied record characterizes the issue as requiring no prior privileges or authentication, with low complexity and no additional victim interaction beyond the attacker's own action. An attacker can open the emergency dialer to enable the MTP service. The supplied record does not establish real-world exploitation, a public exploit, a campaign, or a named victim; that status must not be inferred from the absence of such details.

The flaw can enable the MTP service from the emergency-dialer interface, changing the device's intended access boundary. The primary technical consequence is the risk of unauthorized access to data through MTP. Canonical's assessment includes confidentiality and integrity impact, while NVD records confidentiality impact but not integrity impact, so the exact extent of possible data modification remains uncertain. Neither assessment indicates an availability impact. The physical-access requirement limits remote exploitation but does not remove the risk for unattended devices or deployments in locations without controlled access.

• Data: The MTP service may become available outside its intended access flow, creating a risk of unauthorized access to device data.
• Integrity: Canonical's assessment includes integrity impact, but the record does not specify which data or operations could be changed.
• Operations: Phones deployed in public areas, kiosks, warehouses, or other environments with uncontrolled physical access should be prioritized for review.
• Limit: The record provides no evidence of a specific data breach, exploitation campaign, or availability impact.

1. Upgrade Unity8 on the Ubuntu 16.04 branch to 8.11+16.04.20160111.1-0ubuntu1.
2. For the Ubuntu 15.04 branch, upgrade to 8.11+15.04.20160122-0ubuntu1.
3. Inventory other Unity8 deployments and verify the corresponding fix for each branch; the record does not establish that a fix for one branch covers every other branch.
4. The record provides no confirmed workaround. Until updates are applied, restricting physical access to devices is a temporary risk-reduction measure and does not replace patching.

• Inventory Ubuntu phones and other deployments running Unity8, then compare installed versions with the fixed branches described in the affected and remediation sections.
• Determine whether MTP becomes available after opening the emergency dialer. Perform this only as a controlled validation test, not as a substitute for patching.
• Review device-management, USB, or MTP connection records for unexpected sessions near periods of physical access. This is precautionary monitoring because the record does not define a product-specific log event or IOC.
• Do not treat the absence of an MTP session or log event as proof that a device is safe; confirm the installed version and apply the appropriate fix.