CTS-testIMemoryElevationOfPrivilegeExploit

最新推荐文章于 2023-04-04 14:36:47 发布

xieqiang2008com

最新推荐文章于 2023-04-04 14:36:47 发布

阅读量644

点赞数 2

CC 4.0 BY-SA版权

分类专栏： CTS

本文链接：https://blog.youkuaiyun.com/xieqiang2008com/article/details/62040256

CTS 专栏收录该内容

10 篇文章

订阅专栏

本文介绍了一个存在于Android系统中的IMemory Elevation of Privilege (EOP)漏洞，该漏洞允许攻击者提升权限，从而可能危及系统的安全性。通过分析，我们发现漏洞与不当的内存大小检查有关，并提供了详细的修复方案。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

android.security.cts.IMemoryHeapCorruptionTest 
-- testIMemoryElevationOfPrivilegeExploit 
fail 
junit.framework.AssertionFailedError: Device is vulnerable to bug #26877992!! For more information, refer - https://android.googlesource.com/platform/frameworks/native/+/f3199c228aced7858b75a8070b8358c155ae0149 at junit.framework.Assert.fail(Assert.java:50)

修改方法：

--- a/idh.code/frameworks/native/libs/binder/IMemory.cpp
+++ b/idh.code/frameworks/native/libs/binder/IMemory.cpp
@@ -187,15 +187,26 @@ sp<IMemoryHeap> BpMemory::getMemory(ssize_t* offset, size_t* size) const
             if (heap != 0) {
                 mHeap = interface_cast<IMemoryHeap>(heap);
                 if (mHeap != 0) {
-                    mOffset = o;
-                    mSize = s;
+                    size_t heapSize = mHeap->getSize();
+                    if (s <= heapSize
+                            && o >= 0
+                            && (static_cast<size_t>(o) <= heapSize - s)) {
+                        mOffset = o;
+                        mSize = s;
+                    } else {
+                        // Hm.
+                        android_errorWriteWithInfoLog(0x534e4554,
+                            "26877992", -1, NULL, 0);
+                        mOffset = 0;
+                        mSize = 0;
+                    }
                 }
             }
         }
     }
     if (offset) *offset = mOffset;
     if (size) *size = mSize;
-    return mHeap;
+    return (mSize > 0) ? mHeap : 0;
 }