从Stagefright到Stagescream：流“血”不止的安卓多媒体库.pdf

从Stagefright到Stagescream ： 流”血”不止的安卓多媒体库 吴家志, 吴磊of C0RE Team ABOUT US Ø C0RE Team Founding Members () Ø Working on Android/Linux Security Ø Linux Kernel/3rd-party Drivers: CVE-2015-0568, CVE-2015-4419, … Ø Android Framework/Apps: CVE-2015-3862, CVE-2015-3868, … Ø North Carolina State University PhDs (北卡州立大学博士) Ø Virtualization Security: HyerLock (EuroSys ‘12), DeHype (NDSS ‘13) Ø Mobile Security: Android Malware Genome Project (Oakland ’12), SEFA (CCS ‘13), AirBag (NDSS ’14) libstagefright Ø Linked by privileged processes (e.g., mediaserver) Ø Processing complicated input (e.g., MPEG4, Ogg, OMX files) Ø Activated by processing media files à easy to trigger attacks Picture from /devices/ media.html JDUCK’S FINDINGS Ø Vulnerabilities Ø Seven 0-day stagefright vulnerabilities identified Ø Six of them are rated critical Ø Ways to Exploit AOSP Bugs Ø State-of-the-art results of exploiting the 0-day vulnerabilities BUG ESSENCE #1 Ø Memory Allocation with an “Overflowed” Size Allocating (Size+1) I think I have What you really allocated What happens when you (Size+1) :P is (0xffffffff+1) = nothing! try to access it? Picture from /comics/goto.png BUG ESSENCE #1 Ø Related AOSP Patch BUG ESSENCE #2 Ø Out of Bound Access to Stack/Heap Buffer Ø Due to unsafe size checking logic Picture from / BUG ESSENCE #2 Ø Related AOSP Patch STAGEFRIGHT è STAGESCREAM Ø We found out more 0-day vul.s in Android Multimedia Framework Ø CVE-2015-3873 (Critical Severity, $2,000 awarded) Ø CVE-2015-3869 (Critical Severity, $3,000 awarded) Ø CVE-2015-3868 (Critical Severity, $4,000 awarded) Ø CVE-2015-3862 (Low Severity, $666 awarded) Ø Patches will be released