### Applicability #### Affected Update: All devices currently supported by CalyxOS are affected, but the issue is resolved in CalyxOS 6.6.22 / 6.6.23 and higher. - Devices: Pixel 6 Pro w/ 6.1.1, FP5 w/ 5.13.0. Others may also be affected. - Android version: 14 and 15. Others may also be affected. - Target SDK version: Tested 28, 34. Others may also be affected. - Kernel: 5.4, 5.10. Others may also be affected. #### Not affected - Moto G42 with CalyxOS 5.13.0, kernel 4.19.322-perf - returns "No such file or directory" ### Description It is possible for third-party apps to bypass restrictions on the `/sdcard/Android/data` or `/sdcard/Android/obb` locations by including an ignorable Unicode character like `$'\u200b'` in the path, as reported by a user on Matrix who shared a screenshot of a post by a user on a social media platform. This allows not only listing the contents, but copying the contents out. These folders can be listed even by apps that do not have any files permissions, although in this case, the ability to discover or retrieve the _files_ inside may be limited. ### Steps to reproduce 1. Install an app like Termux or Terminal Emulator and give it storage access. (Terminal Emulator does not need it for some reason.) 2. In the app, enter the following directory-listing command to receive a list of folders in /sdcard as expected: ``` ls /sdcard/ ``` 3. In the app, enter the following directory-listing command and receive a "Permission denied" error as expected: ``` ls /sdcard/Android/data ``` 4. In the app, enter the following directory-listing command that adheres to this exploit: ``` ls /sdcard/Android/data$'\u200b' ``` ### Expected result Receive a "Permission denied" error. ### Actual result Receive a folder listing. ### Impact #### Underprivileged discovery of installed applications At least on some devices or in some conditions, it appears that every app, regardless of its permissions, has a folder auto-populated in `/sdcard/Android/data` corresponding to its package name. Therefore, being able to list its contents provides a comprehensive view of installed apps that can be obtained by invasive third-party apps, and it bypasses the requirement to have the "query all packages" permission in order to gain this information. This is the case for the Pixel 6 Pro (long-term use daily driver device) and Pixel 6a (recently reset) that I have on hand, but not Moto G42 or FP5, which only show org.chromium.chrome. #### Access to semi-private application data Some apps may store data in their designated external storage directories that, while not necessarily highly-sensitive, is revealing enough that it would be better for other apps to not be able to access it. (After all, Android intends to block third-party apps from accessing anything but their own Android/data folders.) Examples: - Organic Maps keeps downloaded map files in `/sdcard/Android/data/app.organicmaps/files/[YYMMDD]/`, which could indirectly reveal some details about the user's location even by their filenames alone. - Syncthing keeps a synchronization log in `/sdcard/Android/data/com.nutomic.syncthingandroid/files/syncthing.log` which reveals connected device names, IDs, IP addresses, etc., along with folder paths and names. Less-bad examples: - Revolution IRC keeps dated chat log databases in uuid subfolders of `/sdcard/Android/data/io.mrarm.irc/files/chat-logs`, but they are only owner-accessible (`0600`), so attempting to access them gives a "Permission denied" error. ### Confirmed fix https://android-review.googlesource.com/q/I01c3f2c98ae4d84269586cec09f18239cbee0abb ~~Per cde, for CalyxOS 5.14:~~ - ~~FP4, FP5: kernels have this fix~~ - ~~Motos: kernels have this fix~~ - ~~Pixel 5: Kernel will have this fix~~ - ~~Pixel 4: Unaffected?~~ - ~~Pixel 3: Kernels don't have this fix~~ - ~~SHIFT6MQ: Kernels don't have this fix~~ ~~CalyxOS 6.1~~ - ~~Pixel 6-9: No fix, waiting for Google~~