A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain
Summary: Google's Threat Analysis Group obtained a partial exploit chain for Samsung Exynos devices, dated late 2020, that TAG believes belonged to a commercial surveillance vendor and was likely captured in the testing phase. The chain used three Samsung-specific vulnerabilities, all patched in March 2021 as CVE-2021-25337, CVE-2021-25369, and CVE-2021-25370, starting with a custom clipboard content provider in the system server that lacked access control and let an untrusted app write files as the system user.
Key Takeaway: The first bug required no memory corruption at all: a missing permission check on a Samsung clipboard provider running as system let any app write a file into /data/system/users/0/, and the chain then reused that same flaw to plant a library path in SamsungTTS settings and load the next stage as system. Three custom Samsung components, one of them a Java content provider, were enough for a suspected commercial spyware vendor to build a working chain against the S10, A50, and A51.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-25337CVE-2021-25369CVE-2021-25370
- Related
- CVE-2021-25370: Samsung Mobile Devices Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 08, 2022CVE-2021-25369: Samsung Mobile Devices Improper Access Control Vulnerability Known Exploited Vulnerabilities · Nov 08, 2022CVE-2021-25337: Samsung Mobile Devices Improper Access Control Vulnerability Known Exploited Vulnerabilities · Nov 08, 2022