● CVE-2024-23712 / Privilege Escalation

CVE-2024-23712: Android Framework Intent Redirection Teardown

How an unvetted nested PendingIntent in Android's ActivityManagerService allowed unprivileged apps to launch internal non-exported activities.

💡 Explication en Termes Simples (ELI5)

Imagine an armored courier service that only delivers packages for the president. A trickster hands the courier a package labeled 'Ordinary Letters', but inside the box is a sealed command order that says 'Evacuate the city'. Because the courier blindly opens the inner box and hands it directly to the military, the fake command is executed as if the president ordered it.

Concepts Clés et Termes du Sous-système

Intent: The messaging object used in Android to request an action from another app component (Activity, Service, Receiver).
PendingIntent: A token given to another app granting it the right to execute an operation using the original creator's permissions.
Non-Exported Component: An internal app component marked `android:exported="false"`, meant to be accessible only by the app itself or system services.
Intent Redirection: Tricking a privileged system component into executing a nested Intent against an internal protected target.

Mécanique d'Exécution Étape par Étape

Step 1

1. Malicious App Initial Access

An untrusted app creates a nested Intent pointing to an internal privileged setting activity.

Step 2

2. Packing into System Service Request

The app wraps the nested Intent inside an ordinary notification or account manager request.

Step 3

3. System Dispatches Intent

The privileged system_server extracts the inner Intent and invokes startActivity().

Step 4

4. Security Policy Bypass

Because the sender is system_server (UID 1000), Android allows launching the non-exported activity.

Code Source : Faille Critique vs. Correctif Sécurisé

Fourni en code source de haut niveau lisible (sans assembleur brut ni diff binaire).

FAILLE NON CORRIGÉE

// VULNERABLE: services/core/java/com/android/server/am/ActivityManagerService.java
public void startServiceWithIntent(Intent wrapperIntent) {
    // ROOT CAUSE:
    // Extracts untrusted nested Intent without validating target component or flags!
    Intent nestedIntent = wrapperIntent.getParcelableExtra("extra_target_intent");
    
    // Dispatches nested intent using SYSTEM_SERVER credentials!
    mContext.startActivity(nestedIntent);
}

CORRECTIF RENFORCÉ

// SECURE: ActivityManagerService.java patch
public void startServiceWithIntent(Intent wrapperIntent) {
    Intent nestedIntent = wrapperIntent.getParcelableExtra("extra_target_intent");
    if (nestedIntent == null) return;
    
    // 1. Resolve target component to verify export status
    ResolveInfo resolveInfo = mContext.getPackageManager().resolveActivity(
        nestedIntent, PackageManager.MATCH_DEFAULT_ONLY);
        
    // 2. Reject non-exported components requested by external apps
    if (resolveInfo != null && !resolveInfo.activityInfo.exported) {
        throw new SecurityException("Permission Denial: target activity is not exported");
    }
    
    // 3. Clear dangerous grant flags before dispatch
    nestedIntent.removeFlags(Intent.FLAG_GRANT_READ_URI_PERMISSION | Intent.FLAG_GRANT_WRITE_URI_PERMISSION);
    mContext.startActivity(nestedIntent);
}

Checklist d'Ingénierie et de Durcissement Système

Never extract and execute nested Intents without checking whether the destination component is exported.
Use `FLAG_IMMUTABLE` when creating all `PendingIntent` objects to prevent callers from altering the target.
Strip URI permission grant flags (`FLAG_GRANT_READ_URI_PERMISSION`) from untrusted nested Intents.
Verify caller identity using `Binder.getCallingUid()` before dispatching internal activities.

← Parcourir l'Annuaire de Sécurité Tous les Bulletins de Sécurité →