Exploit-DB #35913
Description: Android WiFi-Direct - Denial of Service
Type: dos
Platform: android
Date: 2015-01-26
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

Android WiFi-Direct Denial of Service


1. *Advisory Information*

Title: Android WiFi-Direct Denial of Service
Advisory ID: CORE-2015-0002
Advisory URL:
http://www.coresecurity.com/advisories/android-wifi-direct-denial-service
Date published: 2015-01-26
Date of last update: 2015-01-26
Vendors contacted: Android Security Team
Release mode: User release


2. *Vulnerability Information*

Class: Uncaught Exception [CWE-248]
Impact: Denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2014-0997


3. *Vulnerability Description*

  Some Android devices are affected by a Denial of Service attack when
  scanning for WiFi Direct devices.

  An attacker could send a specially crafted 802.11 Probe Response frame
  causing the Dalvik subsystem to reboot because of an Unhandle Exception
  on WiFiMonitor class.


4. *Vulnerable Packages*

  . Nexus 5 - Android 4.4.4
  . Nexus 4 - Android 4.4.4
  . LG D806 - Android 4.2.2
  . Samsung SM-T310 - Android 4.2.2
  . Motorola RAZR HD - Android 4.1.2

  Other devices could be also affected.


5. *Non-vulnerable packages*

  . Android 5.0.1
  . Android 5.0.2


6. *Vendor Information, Solutions and Workarounds*

  Some mitigation actions may be to avoid using WiFi-Direct or update
to a non-vulnerable Android version.
  Contact vendor for further information.

7. *Credits*

  This vulnerability was discovered and researched by Andres Blanco
from the CoreLabs
  Team. The publication of this advisory was coordinated by the Core
Advisories
  Team.


8. *Technical Description / Proof of Concept Code*


  Android makes use of a modified *wpa_supplicant*[1]
  in order to provide an interface between the wireless driver and the
Android platform framework.

  Below the function that handles *wpa_supplicant* events. This function
  returns a jstring from calling NewStringUTF method.

/-----
   static jstring android_net_wifi_waitForEvent(JNIEnv* env, jobject)
   {
       char buf[EVENT_BUF_SIZE];
       int nread = ::wifi_wait_for_event(buf, sizeof buf);
       if (nread > 0) {
           return env->NewStringUTF(buf);
       } else {
       return NULL;
       }
   }
-----/

  The WiFi-Direct specification defines the P2P discovery procedure to
enable P2P
  devices to exchange device information, the device name is part of
this information.

  The WifiP2pDevice class, located at
/wifi/java/android/net/wifi/p2p/WifiP2pDevice.java,
  represents a Wi-Fi p2p device. The constructor method receives the
string provided by
  the *wpa_supplicant* and throws an IllegalArgumentException in case
  the event is malformed.

  Below partial content of the WiFiP2PDevice.java file.

/-----
       [...]

       /** Detailed device string pattern with WFD info
        * Example:
        *  P2P-DEVICE-FOUND 00:18:6b:de:a3:6e
p2p_dev_addr=00:18:6b:de:a3:6e
        *  pri_dev_type=1-0050F204-1 name='DWD-300-DEA36E'
config_methods=0x188
        *  dev_capab=0x21 group_capab=0x9
        */
       private static final Pattern detailedDevicePattern =
Pattern.compile(
           "((?:[0-9a-f]{2}:){5}[0-9a-f]{2}) " +
           "(\\d+ )?" +
           "p2p_dev_addr=((?:[0-9a-f]{2}:){5}[0-9a-f]{2}) " +
           "pri_dev_type=(\\d+-[0-9a-fA-F]+-\\d+) " +
           "name='(.*)' " +
           "config_methods=(0x[0-9a-fA-F]+) " +
           "dev_capab=(0x[0-9a-fA-F]+) " +
           "group_capab=(0x[0-9a-fA-F]+)" +
           "( wfd_dev_info=0x000006([0-9a-fA-F]{12}))?"
       );

       [...]

       /**
        * @param string formats supported include
        *  P2P-DEVICE-FOUND fa:7b:7a:42:02:13
p2p_dev_addr=fa:7b:7a:42:02:13
        *  pri_dev_type=1-0050F204-1 name='p2p-TEST1'
config_methods=0x188 dev_capab=0x27
        *  group_capab=0x0 wfd_dev_info=000006015d022a0032
        *
        *  P2P-DEVICE-LOST p2p_dev_addr=fa:7b:7a:42:02:13
        *
        *  AP-STA-CONNECTED 42:fc:89:a8:96:09
[p2p_dev_addr=02:90:4c:a0:92:54]
        *
        *  AP-STA-DISCONNECTED 42:fc:89:a8:96:09
[p2p_dev_addr=02:90:4c:a0:92:54]
        *
        *  fa:7b:7a:42:02:13
        *
        *  Note: The events formats can be looked up in the
wpa_supplicant code
        * @hide
        */
       public WifiP2pDevice(String string) throws
IllegalArgumentException {
           String[] tokens = string.split("[ \n]");
           Matcher match;

           if (tokens.length < 1) {
               throw new IllegalArgumentException("Malformed supplicant
event");
           }

           switch (tokens.length) {
               case 1:
                   /* Just a device address */
                   deviceAddress = string;
                   return;
               case 2:
                   match = twoTokenPattern.matcher(string);
                   if (!match.find()) {
                       throw new IllegalArgumentException("Malformed
supplicant event");
                   }
                   deviceAddress = match.group(2);
                   return;
               case 3:
                   match = threeTokenPattern.matcher(string);
                   if (!match.find()) {
                       throw new IllegalArgumentException("Malformed
supplicant event");
                   }
                   deviceAddress = match.group(1);
                   return;
               default:
                   match = detailedDevicePattern.matcher(string);
                   if (!match.find()) {
                       throw new IllegalArgumentException("Malformed
supplicant event");
                   }

                   deviceAddress = match.group(3);
                   primaryDeviceType = match.group(4);
                   deviceName = match.group(5);
                   wpsConfigMethodsSupported = parseHex(match.group(6));