The issue is related to the `getDeviceIdForPhone` function in `internal/telephony/PhoneSubInfoController.java`, which lacks protection of service data. This allows a remote attacker to obtain confidential information using a specially crafted application. The function does not check for the `READ PHONE STATE` permission.