In the ever-evolving world of smartphone security, new vulnerabilities are found every year. One notable example from 2022 was CVE-2022-39885, a security flaw in Samsung’s DeviceManagement module, specifically in a component called BootCompletedReceiver_CMCC. In this post, we’ll break down what went wrong, why it happened, and how an attacker could exploit it to get sensitive information from a Samsung device. We’ll also show you code examples to better understand the risk and provide further reading links.

What is CVE-2022-39885?

CVE-2022-39885 is an improper access control vulnerability. Basically, it means some code component didn’t properly check who should be allowed to access certain features or information.

The affected component is the BootCompletedReceiver_CMCC found in the DeviceManagement package of certain Samsung devices, specifically in versions released before SMR Nov-2022 Release 1.

The Short Version

A local attacker (someone who can run code on your device) could use a flaw in this receiver to collect device information they should not have access to.

Understanding the Weak Spot

Android apps (and their pieces, known as Broadcast Receivers) often listen for system events, like when the phone finishes booting up. If these components are not properly secured, any other app on the phone might be able to talk to them and get privileged information.

Here’s how Samsung described the vulnerability in their Security Bulletin:

> "Improper access control vulnerability in BootCompletedReceiver_CMCC in DeviceManagement prior to SMR Nov-2022 Release 1 allows local attacker to access to Device information."

How Did It Happen?

The bug was rooted in a BroadcastReceiver that didn’t restrict who could send it Intents. Normally, these should only be acted on when received from the system (e.g., when the device boots), but here, any app could send their own message and trigger the receiver.

Let's imagine what the vulnerable Android manifest entry might look like

<receiver
    android:name=".BootCompletedReceiver_CMCC"
    android:exported="true">
    <intent-filter>
        <action android:name="android.intent.action.BOOT_COMPLETED" />
    </intent-filter>
</receiver>

When android:exported is true, any app on the phone can send Intents to this receiver, *unless* permissions are checked carefully inside the code — and apparently, they were not.

Exploit Example (Java)

Suppose you’re making a “bad” app to target this. Here’s how the attacker could trigger the vulnerable broadcast:

Intent intent = new Intent();
intent.setComponent(new ComponentName("com.samsung.android.devicemanagement", ".BootCompletedReceiver_CMCC"));
context.sendBroadcast(intent);

If the receiver was exposed and didn’t check the sender or permissions, it might process this intent just as if the phone had booted normally, leaking data as a result.

User or device configuration details

This data can be sensitive: it could help targeted malware avoid detection or even be sold to advertisers or cybercriminals.

How Was It Fixed?

After the vulnerability was reported (credited to Xu Hui), Samsung patched affected models with the November 2022 Security Maintenance Release (SMR Nov-2022 Release 1).

References and Further Reading

- Samsung Security Bulletin - November 2022
- NVD entry for CVE-2022-39885
- Android BroadcastReceiver Security Best Practices

Final Word

CVE-2022-39885 is a great example of how a simple Android configuration mistake can expose sensitive device data. If you own a Samsung phone, always keep your software updated. If you’re a developer, remember to always restrict access to your app’s components, especially broadcast receivers.

Timeline

Published on: 11/09/2022 22:15:00 UTC
Last modified on: 11/10/2022 15:22:00 UTC