|
|
libstagefright integer overflow checks can by bypassed with extended chunk lengths | ||||
| Project Member Reported by natashenka@google.com, Aug 12 2015 | Back to list | ||||
The following fix to an integer overflow issue (part of the stage fright issues presented at BlackHat) does not work as intended: https://android.googlesource.com/platform/frameworks/av/+/f6dda8df18979200a27ca462a9dfa38c11a0e80c%5E!/ The check: + if (SIZE_MAX - chunk_size <= size) { + return ERROR_MALFORMED; + } is ineffective because chunk_size can be a 64 bit value if extended chunk lengths are used. In the attached sample, SIZE_MAX = 0xffffffff, chunk_size = 0xffffffffffffffff and size = 0x40.Therefore, SIZE_MAX - check_size = 0xffffffff00000000 which passes the check as it is more than 0x40. This then causes an integer overflow in the allocation and read: uint8_t *buffer = new (std::nothrow) uint8_t[size + chunk_size]; if (buffer == NULL) { return ERROR_MALFORMED; } if (size > 0) { memcpy(buffer, data, size); } if ((size_t)(mDataSource->readAt(*offset, buffer + size, chunk_size)) This bug is subject to a 90 day disclosure deadline. If 90 days elapse without a broadly available patch, then the bug report will automatically become visible to the public.
Project Member
Comment 1
by
natashenka@google.com,
Aug 13 2015
,
Aug 14 2015
Might as well unrestrict 182559 then...
,
Aug 26 2015
nice
,
Oct 10 2015
Could you please tell me that where i can get the "shellcode.bin" in the Exp file mp4_stagefright_release.py?
,
Oct 29 2015
,
Nov 1 2015
jiangsha, You can use any shellcode, either build from scratch or take an existing one. You can use Zimpirium's remote shell, that was originally taken from Linux ARMLE 'shell_reverse_tcp' then modified to pass environment and fork + exit: https://blog.zimperium.com/the-latest-on-stagefright-cve-2015-1538-exploit-is-now-available-for-testing-purposes Good luck!
,
Nov 1 2015
BTW, anyone knows the exact version of Android 5.x that works with Google's security research exploit? It crashes my LG-G2 (5.0.2) and Samsung S4 (5.0.1).
,
Dec 23 2015
Does the exploit work? You make the assumption that the spray_address is the vtable pointer, which is 0x1c bytes ahead of the virtual function "readAt"(actually stack pivot address),but later when you copy the shellcode, you ignore the offset and just copy from spray_address - 0xed0 to your buffer: page += p32(mmap_address) # r0 = dst page += p32(spray_address - 0xed0) # r1 = src page += p32(0xed0) # r2 = size page += p32(0x33333333) # r3 page += p32(ldr_lr_bx_lr) # pc this is not correct. You need to copy from spray_address - 0xed0 - 0x1c actually. Hope you can clarify this as you are Project Zero!
,
Dec 24 2015
In my test machine only to crash. Output MP4 file has 16M. EXP there may be a problem, right? Thank you ~~~ hope to get help
,
Jan 14 2016
I am seriously wondering if there is a reliably-working exploit against libstagefright. anyone knows? |
|||||
| ► Sign in to add a comment | |||||
