Re: Re: CVE request: Android: vold stack buffer overflow

[Kurt Seifried <kseifried () redhat com>]

On 11/08/2011 06:08 AM, Dan Rosenberg wrote:
> On Tue, Nov 8, 2011 at 8:03 AM, Dan Rosenberg <dan.j.rosenberg () gmail com> wrote:
> > A local user with group "log" on Android may send a malformed message
> > to vold ("volume daemon"), causing a stack buffer overflow.  This has
> > been demonstrated to be exploitable to escalate privileges to root on
> > all Froyo (2.2.x) and Gingerbread (2.4.x)  devices via freeing an
> > arbitrary heap object and triggering a use-after-free condition [1].
> > It appears the bug was silently patched in Honeycomb (3.x), but note
> > that since Honeycomb is not open source, it does not fall within the
> > scope of this list.  Bug discovered and exploited by the Revolutionary
> > team [2].
> Oops, a few minor corrections.
>
> Typo: Gingerbread is 2.3.x.  Also, the vulnerability actually lives in
> the libsysutils library, and was demonstrated to be exploitable via
> vold, which makes use of the affected library function.  Sorry for the
> noise.
>
> > -Dan
> >
> > [1] https://github.com/revolutionary/zergRush/blob/master/zergRush.c
> > [2] http://revolutionary.io/
Please use CVE-2011-4123 for this issue.

-- 

-Kurt Seifried / Red Hat Security Response Team