Su Mon Kywe

The issue is related to the `getDeviceIdForPhone` function in `internal/telephony/PhoneSubInfoController.java`, which lacks protection of service data. This allows a remote attacker to obtain confidential information using a specially crafted application. The function does not check for the `READ PHONE STATE` permission.

The issue allows attackers to bypass intended limits on incorrect passcode entry, and consequently avoid a configured Erase Data setting, by leveraging the presence of an app in the third-party sandbox.

The issue concerns the Telephony subsystem, which does not enforce API conformity for access to telephony-daemon interfaces. This allows attackers to bypass intended restrictions on phone calls by using a crafted app that sends direct requests to the daemon.