Skip to content

Commit 0883529

Browse files
Fuzion24Fuzion24
committed
Merge pull request #61 from Fuzion24/feature/cve-2015-6608
Add check for cve-2015-6608
2 parents cc91221 + d9166ba commit 0883529

File tree

6 files changed

+200
-2
lines changed

6 files changed

+200
-2
lines changed

‎app/app.iml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,6 @@
9090
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/rs" />
9191
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/symbols" />
9292
<excludeFolder url="file://$MODULE_DIR$/build/outputs" />
93-
<excludeFolder url="file://$MODULE_DIR$/build/tmp" />
9493
</content>
9594
<orderEntry type="jdk" jdkName="Android API 23 Platform" jdkType="Android SDK" />
9695
<orderEntry type="sourceFolder" forTests="false" />

‎app/src/main/assets/vuln_map.json

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -477,5 +477,30 @@
477477
"https://android.googlesource.com/platform/frameworks/av/+/6fe85f7e15203e48df2cc3e8e1c4bc6ad49dc968"
478478
],
479479
"cvedate": "09/30/2015"
480+
},
481+
"CVE-2015-6608": {
482+
"cve": "CVE-2015-6608",
483+
"altnames": [
484+
"Stagefright",
485+
"ANDROID-19779574",
486+
"ANDROID-23680780",
487+
"ANDROID-23876444",
488+
"ANDROID-23881715",
489+
"ANDROID-14388161"
490+
],
491+
"description": "During media file and data processing of a specially crafted file, vulnerabilities in mediaserver could allow an attacker to cause memory corruption and remote code execution as the mediaserver process.",
492+
"impact": "The affected functionality is provided as a core part of the operating system and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media. This issue is rated as a Critical severity due to the possibility of remote code execution within the context of the mediaserver service. The mediaserver service has access to audio and video streams as well as access to privileges that third-party apps cannot normally access.",
493+
"external_links": [
494+
"https://groups.google.com/forum/#!topic/android-security-updates/GwZn7sixask"
495+
],
496+
"cvssv2": 10,
497+
"patch": [
498+
"https://android.googlesource.com/platform%2Fframeworks%2Fav/+/8ec845c8fe0f03bc57c901bc484541bdd6a7cf80",
499+
"https://android.googlesource.com/platform%2Fframeworks%2Fav/+/c6a2815eadfce62702d58b3fa3887f24c49e1864",
500+
"https://android.googlesource.com/platform%2Fexternal%2Faac/+/b3c5a4bb8442ab3158fa1f52b790fadc64546f46",
501+
"https://android.googlesource.com/platform%2Fexternal%2Ftremolo/+/3830d0b585ada64ee75dea6da267505b19c622fd",
502+
"https://android.googlesource.com/platform%2Fframeworks%2Fav/+/3878b990f7d53eae7c2cf9246b6ef2db5a049872"
503+
],
504+
"cvedate": "09/30/2015"
480505
}
481506
}

‎app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/VulnerabilityOrganizer.java

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
import fuzion24.device.vulnerability.util.CPUArch;
1212
import fuzion24.device.vulnerability.vulnerabilities.framework.graphics.GraphicBufferTest;
1313
import fuzion24.device.vulnerability.vulnerabilities.framework.media.CVE_2015_6602;
14+
import fuzion24.device.vulnerability.vulnerabilities.framework.media.CVE_2015_6608;
1415
import fuzion24.device.vulnerability.vulnerabilities.framework.media.StageFright;
1516
import fuzion24.device.vulnerability.vulnerabilities.framework.serialization.OpenSSLTransientBug;
1617
import fuzion24.device.vulnerability.vulnerabilities.framework.zip.ZipBug8219321;
@@ -48,11 +49,17 @@ public static List<VulnerabilityTest> getTests(Context ctx){
4849
allTests.add(new CVE_2015_3636());
4950
//tests.add(new ZergRush()); // Hide super old bugs?
5051
allTests.add(new SamsungCREDzip());
52+
allTests.add(new CVE_2015_6608());
5153

5254
List<VulnerabilityTest> filteredTest = new ArrayList<VulnerabilityTest>();
5355
String cpuArch1 = SystemUtils.propertyGet(ctx, "ro.product.cpu.abi");
5456
String cpuArch2 = SystemUtils.propertyGet(ctx, "ro.product.cpu.abi2");
5557

58+
59+
/*
60+
The logic here is:
61+
The test must support every architecture that the device lists
62+
*/
5663
for(VulnerabilityTest vt : allTests){
5764

5865
if(vt.getSupportedArchitectures() == null) {

‎app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/framework/media/CVE_2015_6608.java

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
package fuzion24.device.vulnerability.vulnerabilities.framework.media;
2+
3+
import android.content.Context;
4+
import android.os.Build;
5+
import android.util.Log;
6+
7+
import java.io.ByteArrayOutputStream;
8+
import java.io.File;
9+
import java.io.FileInputStream;
10+
import java.util.ArrayList;
11+
import java.util.List;
12+
13+
import fuzion24.device.vulnerability.util.CPUArch;
14+
import fuzion24.device.vulnerability.vulnerabilities.VulnerabilityTest;
15+
import fuzion24.device.vulnerability.vulnerabilities.helper.BinaryAssets;
16+
import fuzion24.device.vulnerability.vulnerabilities.helper.KMPMatch;
17+
import fuzion24.device.vulnerability.vulnerabilities.helper.SystemUtils;
18+
19+
/**
20+
* Created by fuzion24 on 11/16/15.
21+
*/
22+
23+
24+
/*
25+
https://android.googlesource.com/platform/external/tremolo/+/3830d0b585ada64ee75dea6da267505b19c622fd%5E%21/#F1
26+
https://android.googlesource.com/platform/frameworks/av/+/c6a2815eadfce62702d58b3fa3887f24c49e1864%5E%21/#F0
27+
28+
2|shell@flounder_lte:/ $ grep -F "b/23881715" /system/lib/libstagefright.so
29+
1|shell@flounder_lte:/ $ grep -F "b/23881715" /system/lib64/libstagefright.so
30+
*/
31+
32+
33+
34+
public class CVE_2015_6608 implements VulnerabilityTest {
35+
36+
private static final String TAG = "CVE-2015-6608";
37+
38+
@Override
39+
public String getCVEorID() {
40+
return "CVE-2015-6608";
41+
}
42+
43+
@Override
44+
public boolean isVulnerable(Context context) throws Exception {
45+
/*
46+
The patch includes logging messages for when the vulnerable code paths are hit.
47+
We can simply look for the inclusion of the strings in the libraries to determine
48+
whether or not the device has a patched libstagefright.so
49+
*/
50+
51+
File stagefrightlib = new File("/system/lib/libstagefright.so");
52+
File stagefrightlib64 = new File("/system/lib64/libstagefright.so");
53+
54+
File softAAClib = new File("/system/lib/libstagefright_soft_aacdec.so");
55+
56+
File libvorbisidec = new File("/system/lib/libvorbisidec.so");
57+
58+
if(!stagefrightlib.exists() || !stagefrightlib.isFile()){
59+
throw new Exception("libstagefright.so doesn't exist or is not a file");
60+
}
61+
62+
if(!softAAClib.exists()){
63+
throw new Exception("libstagefright_soft_aacdec.so does not exist");
64+
}
65+
66+
if(!libvorbisidec.exists()){
67+
throw new Exception("libvorbisidec.so does not exist");
68+
}
69+
70+
71+
ByteArrayOutputStream libStageFrightBAOS = new ByteArrayOutputStream((int)stagefrightlib.length());
72+
BinaryAssets.copy(new FileInputStream(stagefrightlib), libStageFrightBAOS);
73+
byte[] libstagefrightSO = libStageFrightBAOS.toByteArray();
74+
75+
76+
ByteArrayOutputStream libaacdecBAOS = new ByteArrayOutputStream((int)softAAClib.length());
77+
BinaryAssets.copy(new FileInputStream(softAAClib), libaacdecBAOS);
78+
byte[] libaacdecSO = libaacdecBAOS.toByteArray();
79+
80+
ByteArrayOutputStream libvorbisidecBAOS = new ByteArrayOutputStream((int)libvorbisidec.length());
81+
BinaryAssets.copy(new FileInputStream(libvorbisidec), libvorbisidecBAOS);
82+
byte[] libvorbisidecSO = libvorbisidecBAOS.toByteArray();
83+
84+
85+
86+
KMPMatch binMatcher = new KMPMatch();
87+
88+
int indexOf = binMatcher.indexOf(libstagefrightSO, "b/23680780".getBytes());
89+
boolean libstagefrightVulnerableToBug23680780 = indexOf == -1;
90+
indexOf = binMatcher.indexOf(libvorbisidecSO, "b/23881715".getBytes());
91+
boolean libstagefrightvulnerableToBug23881715 = indexOf == -1;
92+
indexOf = binMatcher.indexOf(libaacdecSO, "b/23876444".getBytes());
93+
boolean libstagefrightVulnerableToBug23876444 = indexOf == -1;
94+
95+
96+
Log.d(TAG, "libstagefrightVulnerableToBug23680780: " + libstagefrightVulnerableToBug23680780);
97+
Log.d(TAG, "libstagefrightvulnerableToBug23881715: " + libstagefrightvulnerableToBug23881715);
98+
Log.d(TAG, "libstagefrightVulnerableToBug23876444: " + libstagefrightVulnerableToBug23876444);
99+
100+
//Only affects L and M
101+
if(Build.VERSION.SDK_INT != Build.VERSION_CODES.M && Build.VERSION.SDK_INT != Build.VERSION_CODES.LOLLIPOP){
102+
return false;
103+
}
104+
105+
return libstagefrightVulnerableToBug23680780 ||
106+
libstagefrightvulnerableToBug23881715 ||
107+
libstagefrightVulnerableToBug23876444;
108+
109+
}
110+
111+
@Override
112+
public List<CPUArch> getSupportedArchitectures() {
113+
List<CPUArch> supportedArchs = new ArrayList<CPUArch>();
114+
supportedArchs.add(CPUArch.ARM7);
115+
supportedArchs.add(CPUArch.ARM8);
116+
supportedArchs.add(CPUArch.X86);
117+
return supportedArchs;
118+
}
119+
}

‎app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/helper/BinaryAssets.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ public static void extractAsset(Context ctx, String name, String destination, bo
4545
}
4646

4747
private static final int BUFFER_SIZE = 2 * 1024 * 1024;
48-
private static void copy(InputStream input, OutputStream output) throws IOException {
48+
public static void copy(InputStream input, OutputStream output) throws IOException {
4949
try {
5050
byte[] buffer = new byte[BUFFER_SIZE];
5151
int bytesRead = input.read(buffer);

‎app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/helper/KMPMatch.java

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
package fuzion24.device.vulnerability.vulnerabilities.helper;
2+
/**
3+
* Knuth-Morris-Pratt Algorithm for Pattern Matching
4+
*/
5+
public class KMPMatch {
6+
/**
7+
* Finds the first occurrence of the pattern in the text.
8+
*/
9+
public int indexOf(byte[] data, byte[] pattern) {
10+
int[] failure = computeFailure(pattern);
11+
12+
int j = 0;
13+
if (data.length == 0) return -1;
14+
15+
for (int i = 0; i < data.length; i++) {
16+
while (j > 0 && pattern[j] != data[i]) {
17+
j = failure[j - 1];
18+
}
19+
if (pattern[j] == data[i]) { j++; }
20+
if (j == pattern.length) {
21+
return i - pattern.length + 1;
22+
}
23+
}
24+
return -1;
25+
}
26+
27+
/**
28+
* Computes the failure function using a boot-strapping process,
29+
* where the pattern is matched against itself.
30+
*/
31+
private int[] computeFailure(byte[] pattern) {
32+
int[] failure = new int[pattern.length];
33+
34+
int j = 0;
35+
for (int i = 1; i < pattern.length; i++) {
36+
while (j > 0 && pattern[j] != pattern[i]) {
37+
j = failure[j - 1];
38+
}
39+
if (pattern[j] == pattern[i]) {
40+
j++;
41+
}
42+
failure[i] = j;
43+
}
44+
45+
return failure;
46+
}
47+
}
48+

0 commit comments

Comments
 (0)