Direct physical memory Read and write vulnerabilities on the Android platform

/*

This article is prepared by Mo Gray Ash, reproduced please indicate the source.

mo Ash Gray mailbox: [email protected]

*/

The vulnerability of direct manipulation of physical memory through mmap should be considered a more common type of vulnerability, in 2012, 2013 of this period, there are several physical memory read-write related vulnerabilities. The main reason is that some devices have the function of mmap physical memory, but their permissions are globally readable, and finally, the hacker can achieve the purpose of privilege promotion by carefully constructed parameters, patch related functions or data structures.

This kind of equipment mainly has the following several

/dev/exynos-mem cve-2012-6422 http://blog.csdn.net/hu3167343/article/details/34425995

/DEV/MSM_CAMERA/CONFIG0 cve-2013-2595 http://blog.csdn.net/hu3167343/article/details/34434235

/dev/dhcp

/dev/graphics/fb0

(The following two did not search for CVE numbers, but they are available on the Code network)

The formation of this kind of vulnerability is mainly the programmer that writes the drive device implements the Mmap method in the driver, but does not have the verification parameter, for example to the caller, the map address to do the verification and so on.

There is/dev/msm_camera/config0 equipment, itself does not need to mmap methods, programmers in writing the driver when the template, and finally buried a pit.