CVE-2023-38302

Executive Summary

CVE-2023-38302 identifies a critical information disclosure vulnerability in the Sharp Rouvo V mobile device (Android 12 build). The vulnerability allows any local application, without any permissions, to read the device's Wi-Fi MAC address and Bluetooth MAC address via the system properties ro.boot.wifi_mac and ro.boot.bt_mac. This bypasses Android 10+ restrictions that prevent third-party apps from directly accessing non-resettable device identifiers. The leak originates from a high-privilege process that exposes these identifiers to the system property space, which is readable by any app.

Impact: Any malicious app installed on the device can silently harvest persistent hardware identifiers, enabling device tracking, user profiling, and potential correlation with other data sources. This undermines user privacy and security controls implemented in modern Android versions.

Affected Ecosystem: Android (Sharp Rouvo V specific build). Not a WordPress, NPM, PyPI, Go, or Ruby package.

Supply Chain & Package Security

Not applicable. This is a firmware-level vulnerability in a specific Android device build, not a software package dependency.

CVSS Breakdown & Threat Level

The NVD CVSS score is 0.0, likely due to incomplete scoring. Based on the vulnerability characteristics, a more realistic CVSS v3.1 vector would be:

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Local (requires a malicious app installed on the device)
• Attack Complexity (AC): Low (no special conditions)
• Privileges Required (PR): None (no permissions needed)
• User Interaction (UI): None (app runs silently)
• Scope (S): Unchanged
• Confidentiality (C): High (exposes unique device identifiers)
• Integrity (I): None
• Availability (A): None

Threat Level: Medium-High. While the attack surface is local, the ease of exploitation and the value of persistent hardware identifiers make this a significant privacy risk.

Deep Dive & Mechanics

The vulnerability stems from the Android system initialization process on the Sharp Rouvo V. During boot, the bootloader passes hardware identifiers to the kernel via device tree or kernel command line. These are then exposed as read-only system properties (ro.boot.*). Normally, these properties are protected by SELinux policies or restricted to system-level access. However, in this specific build, the SELinux context for these properties is misconfigured, allowing any app (even with targetSdkVersion=1) to read them via android.os.SystemProperties.get().

Technical Flow:

1. Bootloader reads Wi-Fi MAC from EEPROM/efuse and Bluetooth MAC from Bluetooth controller.
2. Bootloader passes these as kernel cmdline parameters: androidboot.wifi_mac=XX:XX:XX:XX:XX:XX androidboot.bt_mac=YY:YY:YY:YY:YY:YY
3. init process sets ro.boot.wifi_mac and ro.boot.bt_mac system properties.
4. SELinux policy allows untrusted_app domain to read ro.boot.* properties (misconfiguration).
5. Malicious app calls SystemProperties.get("ro.boot.wifi_mac") and SystemProperties.get("ro.boot.bt_mac") without any permissions.

Why this bypasses Android 10+ restrictions: Android 10+ blocks direct access to WifiManager.getConnectionInfo().getMacAddress() and BluetoothAdapter.getAddress() for non-system apps. However, system properties are a separate channel that was not properly locked down.

Vulnerable vs. Patched Code

Vulnerable Code (Android system property access):

// Malicious app code - no permissions needed
String wifiMac = SystemProperties.get("ro.boot.wifi_mac");
String btMac = SystemProperties.get("ro.boot.bt_mac");
// wifiMac and btMac now contain the MAC addresses

Patched Code (Expected fix):

// In init.rc or SELinux policy
// Restrict access to ro.boot.* properties to only system apps
// Example SELinux rule:
// allow system_app ro_boot_prop:file read;
// neverallow untrusted_app ro_boot_prop:file read;

Patch Details: No official patch has been released by Sharp as of the last update. The fix would require:

1. Modifying the SELinux policy to deny untrusted_app and priv_app domains from reading ro.boot.* properties.
2. Alternatively, removing the exposure of these properties from the boot process entirely and using protected APIs.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Sharp Rouvo V device with the vulnerable build.
• Ability to install a malicious APK (e.g., via sideloading, phishing, or malicious app store).

Exploitation Steps:

1. Create an Android app with no permissions declared in AndroidManifest.xml.
2. Use reflection to access the hidden SystemProperties class:

import java.lang.reflect.Method;

public String getSystemProperty(String key) {
    try {
        Class<?> systemProperties = Class.forName("android.os.SystemProperties");
        Method get = systemProperties.getMethod("get", String.class);
        return (String) get.invoke(null, key);
    } catch (Exception e) {
        return null;
    }
}

// In main activity
String wifiMac = getSystemProperty("ro.boot.wifi_mac");
String btMac = getSystemProperty("ro.boot.bt_mac");

3. Exfiltrate the MAC addresses to a remote server via HTTP POST.
4. Combine with other leaked identifiers (Android ID, etc.) for device fingerprinting.

Expected Output:

Wi-Fi MAC: 12:34:56:78:9A:BC
Bluetooth MAC: DE:F0:12:34:56:78

Blue Team (Detection & Forensics)

Detection on Device:

• Monitor for apps accessing ro.boot.wifi_mac or ro.boot.bt_mac system properties. This can be done via logcat with adb logcat -s SystemProperties:* and looking for get calls.
• Check for apps with no permissions that are making network connections to unknown servers.

Forensic Analysis:

• Extract the installed packages list and look for apps with targetSdkVersion < 29 (though not required for this exploit).
• Analyze network traffic for exfiltration of MAC addresses (look for patterns like XX:XX:XX:XX:XX:XX in HTTP POST bodies).
• Check dumpsys output for property access logs (if available).

Mitigation for Blue Team:

• Apply any OTA update from Sharp if released.
• Use a mobile device management (MDM) solution to restrict app installation from unknown sources.
• Monitor for apps requesting no permissions but making network calls.

Indicators of Compromise (IOCs)

System Properties Accessed:

• ro.boot.wifi_mac
• ro.boot.bt_mac

Logcat Patterns:

SystemProperties: get: ro.boot.wifi_mac
SystemProperties: get: ro.boot.bt_mac

Network Traffic:

• HTTP POST requests containing MAC address patterns (e.g., 12:34:56:78:9A:BC).
• Destination IPs/domains associated with known tracking or ad networks.

File System Artifacts:

• APK files with no permissions declared but containing reflection code for android.os.SystemProperties.

YARA Rule:

rule CVE_2023_38302_MAC_Leak {
    meta:
        description = "Detects apps exploiting CVE-2023-38302 to leak Wi-Fi/Bluetooth MAC addresses"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-38302"
    strings:
        $s1 = "ro.boot.wifi_mac" ascii wide
        $s2 = "ro.boot.bt_mac" ascii wide
        $s3 = "SystemProperties" ascii wide
        $s4 = "getProperty" ascii wide
        $s5 = "get(" ascii wide
    condition:
        (any of ($s1, $s2)) and (any of ($s3, $s4, $s5))
}

Detection Engineering

YARA Rule

rule CVE_2023_38302_Exploit_APK {
    meta:
        description = "Detects APK files attempting to exploit CVE-2023-38302"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-38302"
    strings:
        $prop1 = "ro.boot.wifi_mac" ascii
        $prop2 = "ro.boot.bt_mac" ascii
        $class = "android.os.SystemProperties" ascii
        $method = "get" ascii
    condition:
        (any of ($prop1, $prop2)) and $class and $method
}

Sigma Rule

title: CVE-2023-38302 - Sharp Rouvo V MAC Address Leak via System Properties
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects access to ro.boot.wifi_mac and ro.boot.bt_mac system properties by untrusted apps
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38302
logsource:
    product: android
    service: logcat
detection:
    selection:
        - "ro.boot.wifi_mac"
        - "ro.boot.bt_mac"
    condition: selection
falsepositives:
    - System apps with legitimate access (should be rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-38302 - Potential MAC Address Exfiltration"; content:"POST"; http_method; content:"ro.boot.wifi_mac"; http_client_body; content:"ro.boot.bt_mac"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Check Device Build: Verify if your Sharp Rouvo V is running the vulnerable build (SP1A.210812.016/1KN0_0_530).
2. Restrict App Installation: Disable installation from unknown sources. Only install apps from Google Play Store.
3. Use a Firewall: Employ a firewall app (e.g., NetGuard) to block network access for apps that don't need it.
4. Monitor for Suspicious Apps: Regularly review installed apps and revoke permissions for any that seem unnecessary.

Long-Term Fix:

• Vendor Patch: Await an OTA update from Sharp that corrects the SELinux policy.
• Custom ROM: If available, flash a custom ROM (e.g., LineageOS) that has proper SELinux policies.
• Root Workaround: For rooted devices, manually modify the SELinux policy to deny untrusted_app access to ro.boot.* properties.

Workaround Code (for rooted devices):

# Add SELinux rule to block untrusted apps
adb shell su -c "supolicy --live 'deny untrusted_app ro_boot_prop:file read'"

Valters IT
DevSecOps & Cyber Threat Intelligence
Report generated for CVE-2023-38302