# CVE-2021-25337: Samsung file system r/w in clipboard provider

Exported SemClipboardProvider in Samsung system server lacked access control, letting any app insert a _data path and get an r/w fd to arbitrary files.

- Payout: Real-world hack
- Severity: high
- Program: Samsung Android
- Credited: Maddie Stone
- Disclosed: 2021-03-01
- CVE: CVE-2021-25337
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2021/CVE-2021-25337.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2021-25337
- Tags: domain:mobile impact:integrity impact:privesc kind:incident platform:project-zero sev:high technique:chained technique:source-review vuln:access-control vuln:path-traversal

**Target:** Android content provider (SemClipboardProvider) in system server
**Root cause:** SemClipboardProvider was exported with no permission and accepted a client-supplied _data column, which openFileHelper resolves to a filesystem path and returns a ParcelFileDescriptor for, bypassing Linux/SELinux file permissions.
**Steps:**
1. Build ContentValues with `_data` = target path e.g. `/data/system/users/0/newFile.bin`
2. `resolver.insert(Uri.parse("content://com.sec.android.semclipboardprovider"), vals)` to create row
3. `resolver.openFileDescriptor(newFile_uri, "w").getFd()` to obtain native fd
4. Use fd to read/write the file despite app sandbox restrictions
**How found:** Likely code auditing: provider declared exported with no permission and insert/update/delete lacked UID checks; static analysis also plausible.
**Exploitation:** Used 4x in an in-the-wild chain: (1) write stage-2 ELF to filesystem, (2) overwrite SamsungTTS settings file to load the ELF, (3) same via alternate settings path, (4) open fd to dpu driver to issue IOCTL for kernel privilege escalation; chained with a kernel info leak and kernel priv esc, requiring a prior app-context foothold.
**Escalation:** Chained file-write primitive into code loading via TTS settings and into a dpu driver IOCTL for kernel privesc.
**Insight:** Audit exported content providers in system_server (framework-res.apk manifest) for client-writable `_data` columns — openFileHelper turns any such column into an arbitrary-path fd, bypassing SELinux.