Skip to content

Commit bd9af53

Browse files
author
kayji
committed
Added CVE-2016-0808 and removed android-vts.iml, app/app.iml
1 parent 2bcc763 commit bd9af53

File tree

7 files changed

+217
-29
lines changed

7 files changed

+217
-29
lines changed

‎android-vts.iml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<module external.linked.project.id="android-vts" external.linked.project.path="$MODULE_DIR$" external.root.project.path="$MODULE_DIR$" external.system.id="GRADLE" external.system.module.group="" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
3+
<component name="FacetManager">
4+
<facet type="java-gradle" name="Java-Gradle">
5+
<configuration>
6+
<option name="BUILD_FOLDER_PATH" value="$MODULE_DIR$/build" />
7+
<option name="BUILDABLE" value="false" />
8+
</configuration>
9+
</facet>
10+
</component>
11+
<component name="NewModuleRootManager" LANGUAGE_LEVEL="JDK_1_7" inherit-compiler-output="true">
12+
<exclude-output />
13+
<content url="file://$MODULE_DIR$">
14+
<excludeFolder url="file://$MODULE_DIR$/.gradle" />
15+
</content>
16+
<orderEntry type="inheritedJdk" />
17+
<orderEntry type="sourceFolder" forTests="false" />
18+
</component>
19+
</module>

‎app/app.iml

Lines changed: 15 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<module external.linked.project.id=":app" external.linked.project.path="$MODULE_DIR$" external.root.project.path="$MODULE_DIR$/.." external.system.id="GRADLE" external.system.module.group="androidVTS" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
2+
<module external.linked.project.id=":app" external.linked.project.path="$MODULE_DIR$" external.root.project.path="$MODULE_DIR$/.." external.system.id="GRADLE" external.system.module.group="android-vts" external.system.module.version="unspecified" type="JAVA_MODULE" version="4">
33
<component name="FacetManager">
44
<facet type="android-gradle" name="Android-Gradle">
55
<configuration>
@@ -63,49 +63,35 @@
6363
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/java" isTestSource="true" />
6464
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/jni" isTestSource="true" />
6565
<sourceFolder url="file://$MODULE_DIR$/src/androidTest/rs" isTestSource="true" />
66-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/assets" />
67-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/bundles" />
68-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/classes" />
69-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/coverage-instrumented-classes" />
70-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/dependency-cache" />
71-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/dex" />
72-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/dex-cache" />
7366
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.android.support/appcompat-v7/23.1.1/jars" />
7467
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.android.support/cardview-v7/23.1.1/jars" />
7568
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.android.support/design/23.1.1/jars" />
7669
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.android.support/recyclerview-v7/23.1.1/jars" />
7770
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.android.support/support-v4/23.1.1/jars" />
78-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.github.afollestad.material-dialogs/core/0.8.5.0/jars" />
7971
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/com.github.paolorotolo/appintro/3.3.0/jars" />
80-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/me.zhanghai.android.materialprogressbar/library/1.1.4/jars" />
81-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/incremental" />
82-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/jacoco" />
83-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/javaResources" />
84-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/libs" />
85-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/lint" />
86-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/manifests" />
87-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/ndk" />
88-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/pre-dexed" />
89-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/proguard" />
90-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/res" />
91-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/rs" />
92-
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/symbols" />
72+
<excludeFolder url="file://$MODULE_DIR$/build/intermediates/exploded-aar/io.reactivex/rxandroid/1.0.1/jars" />
9373
<excludeFolder url="file://$MODULE_DIR$/build/outputs" />
9474
<excludeFolder url="file://$MODULE_DIR$/build/tmp" />
9575
</content>
9676
<orderEntry type="jdk" jdkName="Android API 23 Platform" jdkType="Android SDK" />
9777
<orderEntry type="sourceFolder" forTests="false" />
98-
<orderEntry type="library" exported="" name="recyclerview-v7-23.1.1" level="project" />
78+
<orderEntry type="library" exported="" name="xz-1.2" level="project" />
79+
<orderEntry type="library" exported="" name="rxandroid-1.0.1" level="project" />
80+
<orderEntry type="library" exported="" name="support-annotations-23.1.1" level="project" />
81+
<orderEntry type="library" exported="" name="design-23.1.1" level="project" />
82+
<orderEntry type="library" exported="" name="okhttp-3.0.0-RC1" level="project" />
83+
<orderEntry type="library" exported="" name="retrofit-2.0.0-beta3" level="project" />
84+
<orderEntry type="library" exported="" name="converter-gson-2.0.0-beta3" level="project" />
9985
<orderEntry type="library" exported="" name="appintro-3.3.0" level="project" />
10086
<orderEntry type="library" exported="" name="commons-io-2.4" level="project" />
87+
<orderEntry type="library" exported="" name="rxjava-1.1.0" level="project" />
88+
<orderEntry type="library" exported="" name="recyclerview-v7-23.1.1" level="project" />
10189
<orderEntry type="library" exported="" name="support-v4-23.1.1" level="project" />
102-
<orderEntry type="library" exported="" name="library-1.1.4" level="project" />
103-
<orderEntry type="library" exported="" name="cardview-v7-23.1.1" level="project" />
104-
<orderEntry type="library" exported="" name="xz-1.2" level="project" />
105-
<orderEntry type="library" exported="" name="support-annotations-23.1.1" level="project" />
10690
<orderEntry type="library" exported="" name="appcompat-v7-23.1.1" level="project" />
91+
<orderEntry type="library" exported="" name="okio-1.6.0" level="project" />
92+
<orderEntry type="library" exported="" name="adapter-rxjava-2.0.0-beta3" level="project" />
93+
<orderEntry type="library" exported="" name="cardview-v7-23.1.1" level="project" />
94+
<orderEntry type="library" exported="" name="gson-2.4" level="project" />
10795
<orderEntry type="library" exported="" name="commons-compress-1.5" level="project" />
108-
<orderEntry type="library" exported="" name="design-23.1.1" level="project" />
109-
<orderEntry type="library" exported="" name="core-0.8.5.0" level="project" />
11096
</component>
11197
</module>

‎app/src/main/assets/vuln_map.json

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,18 @@
11
{
2+
"CVE-2016-0808": {
3+
"cve": "CVE-2016-0808",
4+
"altnames": [],
5+
"description": "This vulnerability is what is known as a denial-of-service which gives a malicious application or individual the ability to cause continuous rebooting",
6+
"impact": "Continuous reboot",
7+
"external_links": [
8+
"https://android.googlesource.com/platform/frameworks/minikin/+/ed4c8d79153baab7f26562afb8930652dfbf853b"
9+
],
10+
"patch": [
11+
"https://android.googlesource.com/platform/frameworks/minikin/+/ed4c8d79153baab7f26562afb8930652dfbf853b%5E%21/#F0"
12+
],
13+
"cvssv2": 4.9,
14+
"cvedate": "02/01/2016"
15+
},
216
"CVE-2015-3636": {
317
"cve": "CVE-2015-3636",
418
"altnames": [
@@ -531,5 +545,56 @@
531545
"https://android.googlesource.com/platform%2Fexternal%2Flibavc/+/2ee0c1bced131ffb06d1b430b08a202cd3a52005"
532546
],
533547
"cvedate": "10/12/2015"
548+
549+
},
550+
"CVE-2009-1185": {
551+
"cve": "CVE-2009-1185",
552+
"altnames": [],
553+
"description": "This vulnerability is known as a privilege escalation vulnerability which gives a malicious application or individual the ability to obtain complete access to a vulnerable device. The specific vulnerability resides in a flaw in udev where it does not properly validate the origin of certain messages.",
554+
"impact": "Local privilege escalation to kernel/root from an unprivileged app",
555+
"external_links": [],
556+
"cvssv2": 7.2,
557+
"patch": [],
558+
"cvedate": "04/17/2009"
559+
},
560+
"CVE-2012-6422": {
561+
"cve": "CVE-2012-6422",
562+
"altnames": [],
563+
"description": "This vulnerability primarily impacts Samsung Galaxy S2 and S2 Note devices however other devices using an Exynos model 4210 and 4412 processors may also be affected. The vulnerability would allow an attacker or malicious application the ability to gain privileges on the device.",
564+
"impact": "Local privilege escalation to kernel/root from an unprivileged app",
565+
"external_links": [],
566+
"cvssv2": 9.3,
567+
"patch": [],
568+
"cvedate": "12/17/2012"
569+
},
570+
"CVE-2011-1350": {
571+
"cve": "CVE-2011-1350",
572+
"altnames": [],
573+
"description": "This vulnerability may allow a malicious application or attacker the ability to retrieve potentially sensitive information from an impacted device’s memory.",
574+
"impact": "Local privilege escalation to kernel/root from an unprivileged app",
575+
"external_links": [],
576+
"cvssv2": 7.1,
577+
"patch": [],
578+
"cvedate": "02/05/2013"
579+
},
580+
"CVE-2012-0056": {
581+
"cve": "CVE-2012-0056",
582+
"altnames": [],
583+
"description": "This vulnerability is known as a privilege escalation vulnerability which a gives a malicious application or individual that ability to obtain complete access to a vulnerable device. Note that if your device is running a version of Android that has ALSR enabled (4.1 and above) exploitation of this vulnerability is mitigated.",
584+
"impact": "Local privilege escalation to kernel/root from an unprivileged app",
585+
"external_links": [],
586+
"cvssv2": 6.9,
587+
"patch": [],
588+
"cvedate": "01/27/2012"
589+
},
590+
"CVE-2009-2692": {
591+
"cve": "CVE-2009-2692",
592+
"altnames": [],
593+
"description": "This vulnerability is known as a privilege escalation vulnerability which a gives a malicious application or individual that ability to obtain complete access to a vulnerable device.",
594+
"impact": "Local privilege escalation to kernel/root from an unprivileged app",
595+
"external_links": [],
596+
"cvssv2": 7.2,
597+
"patch": [],
598+
"cvedate": "08/14/2009"
534599
}
535600
}

‎app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/VulnerabilityOrganizer.java

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
import java.util.List;
99

1010
import fuzion24.device.vulnerability.util.CPUArch;
11+
import fuzion24.device.vulnerability.vulnerabilities.framework.graphics.CVE_2016_0808;
1112
import fuzion24.device.vulnerability.vulnerabilities.framework.graphics.GraphicBufferTest;
1213
import fuzion24.device.vulnerability.vulnerabilities.framework.media.CVE_2015_6602;
1314
import fuzion24.device.vulnerability.vulnerabilities.framework.media.CVE_2015_6608;
@@ -33,7 +34,10 @@ public class VulnerabilityOrganizer {
3334

3435
//TODO: Maybe add dates to each of these and sort chronologically
3536
public static List<VulnerabilityTest> getTests(Context ctx){
37+
3638
List<VulnerabilityTest> allTests = new ArrayList<>();
39+
40+
allTests.add(new CVE_2016_0808());
3741
allTests.add(new ZipBug9950697());
3842
allTests.add(new ZipBug8219321());
3943
allTests.add(new ZipBug9695860());

‎app/src/main/java/fuzion24/device/vulnerability/vulnerabilities/framework/graphics/CVE_2016_0808.java

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
package fuzion24.device.vulnerability.vulnerabilities.framework.graphics;
2+
3+
import android.content.Context;
4+
5+
import java.util.ArrayList;
6+
import java.util.List;
7+
8+
import fuzion24.device.vulnerability.util.CPUArch;
9+
import fuzion24.device.vulnerability.vulnerabilities.VulnerabilityTest;
10+
11+
/**
12+
* Created by kg on 09/03/16.
13+
*/
14+
public class CVE_2016_0808 implements VulnerabilityTest{
15+
static {
16+
System.loadLibrary("cve-2016-0808");
17+
}
18+
19+
@Override
20+
public String getCVEorID() {
21+
return "CVE-2016-0808";
22+
}
23+
24+
@Override
25+
public boolean isVulnerable(Context context) throws Exception {
26+
int checkVal = checkCVE20160808();
27+
if(checkVal == 0) {
28+
return false;
29+
}else if(checkVal == 1) {
30+
return true;
31+
}else {
32+
throw new Exception("Error running test");
33+
}
34+
}
35+
36+
@Override
37+
public List<CPUArch> getSupportedArchitectures() {
38+
ArrayList<CPUArch> archs = new ArrayList<CPUArch>();
39+
archs.add(CPUArch.ARM7);
40+
archs.add(CPUArch.ARM);
41+
return archs;
42+
}
43+
44+
private native int checkCVE20160808();
45+
}

‎app/src/main/jni/Android.mk

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -227,3 +227,23 @@ LOCAL_C_INCLUDES := $(LOCAL_PATH)/include/
227227

228228
include $(BUILD_EXECUTABLE)
229229
################################
230+
231+
################################
232+
include $(CLEAR_VARS)
233+
234+
LOCAL_MODULE := cve-2016-0808
235+
LOCAL_SRC_FILES := cve20160808.c
236+
237+
include $(BUILD_SHARED_LIBRARY)
238+
################################
239+
240+
################################
241+
include $(CLEAR_VARS)
242+
243+
LOCAL_MODULE := cve-2016-0808check
244+
LOCAL_SRC_FILES := cve20160808.c
245+
246+
include $(BUILD_EXECUTABLE)
247+
################################
248+
249+

‎app/src/main/jni/cve20160808.c

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
#include <jni.h>
2+
#include <stdio.h>
3+
#include <stdlib.h>
4+
#include <stdint.h>
5+
#include <android/log.h>
6+
7+
int checkIsVulnerable(){
8+
FILE *file;
9+
long size;
10+
uint8_t *buffer;
11+
int result;
12+
13+
14+
file = fopen("/system/lib/libminikin.so", "rb");
15+
16+
if(file == NULL){
17+
result = 0;
18+
goto done;
19+
}
20+
21+
fseek(file, 0, SEEK_END);
22+
size = ftell(file);
23+
rewind(file);
24+
25+
buffer = (uint8_t *)malloc(sizeof(char)*size);
26+
27+
fread(buffer, 1, size, file);
28+
uint8_t needle[4] = {0x53, 0x55, 0x55, 0x15};
29+
30+
uint8_t *p = memmem(buffer, size, needle, 4);
31+
if(p)
32+
result = 0;
33+
else
34+
result = 1;
35+
36+
fclose(file);
37+
free(buffer);
38+
39+
done:
40+
return result;
41+
}
42+
43+
JNIEXPORT jint JNICALL Java_fuzion24_device_vulnerability_vulnerabilities_framework_graphics_CVE_12016_10808_checkCVE20160808(JNIEnv *env, jobject obj){
44+
return checkIsVulnerable();
45+
}
46+
47+
int main(void){
48+
return checkIsVulnerable();
49+
}

0 commit comments

Comments
 (0)