Exploit-DB #45579
Description: WhatsApp - RTP Processing Heap Corruption
Type: dos
Platform: android
Date: 2018-10-10
Author: Google Security Research

Exploit:
Heap corruption can occur when the WhatsApp mobile application receives a malformed RTP packet.

08-31 15:43:50.721  9428  9713 F libc    : Fatal signal 11 (SIGSEGV), code 1, fault addr 0x[PII_REDACTED] in tid 9713 (Thread-11)
08-31 15:43:50.722   382   382 W         : debuggerd: handling request: pid=9428 uid=10119 gid=10119 tid=9713
08-31 15:43:50.818  9720  9720 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
08-31 15:43:50.818  9720  9720 F DEBUG   : Build fingerprint: 'google/angler/angler:7.1.2/N2G48H/natash11071827:userdebug/dev-keys'
08-31 15:43:50.818  9720  9720 F DEBUG   : Revision: '0'
08-31 15:43:50.818  9720  9720 F DEBUG   : ABI: 'arm64'
08-31 15:43:50.818  9720  9720 F DEBUG   : pid: 9428, tid: 9713, name: Thread-11  >>> com.whatsapp <<<
08-31 15:43:50.818  9720  9720 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x[PII_REDACTED]
08-31 15:43:50.819  9720  9720 F DEBUG   :     x0  [PII_REDACTED]1ffde8  x1  [PII_REDACTED]7796b0  x2   [PII_REDACTED]  x3   [PII_REDACTED]
08-31 15:43:50.819  9720  9720 F DEBUG   :     x4   [PII_REDACTED]  x5   [PII_REDACTED]  x6  [PII_REDACTED]1fffd8  x7   [PII_REDACTED]
08-31 15:43:50.819  9720  9720 F DEBUG   :     x8   [PII_REDACTED]  x9   [PII_REDACTED]  x10  [PII_REDACTED]  x11  [PII_REDACTED]
08-31 15:43:50.819  9720  9720 F DEBUG   :     x12  [PII_REDACTED]  x13  [PII_REDACTED]  x14  [PII_REDACTED]  x15  [PII_REDACTED]
08-31 15:43:50.819  9720  9720 F DEBUG   :     x16 [PII_REDACTED]a468a0  x17  000000712f3b0908  x18  [PII_REDACTED]  x19  [PII_REDACTED]
08-31 15:43:50.819  9720  9720 F DEBUG   :     x20 [PII_REDACTED]8744a8  x21  [PII_REDACTED]  x22 [PII_REDACTED]6a5a28  x23 [PII_REDACTED]ff9b70
08-31 15:43:50.819  9720  9720 F DEBUG   :     x24 [PII_REDACTED]00100d  x25 [PII_REDACTED]00120d  x26  [PII_REDACTED]  x27  [PII_REDACTED]
08-31 15:43:50.819  9720  9720 F DEBUG   :     x28 [PII_REDACTED]151f80  x29 [PII_REDACTED]3fe540  x30 [PII_REDACTED]60a010
08-31 15:43:50.819  9720  9720 F DEBUG   :     sp  [PII_REDACTED]3fe320  pc   000000712f3b0a5c  pstate [PII_REDACTED]
08-31 15:43:50.825  9720  9720 F DEBUG   : 
08-31 15:43:50.825  9720  9720 F DEBUG   : backtrace:
08-31 15:43:50.825  9720  9720 F DEBUG   :     #00 pc[PII_REDACTED]01aa5c  /system/lib64/libc.so (memcpy+340)
08-31 15:43:50.825  9720  9720 F DEBUG   :     #01 pc[PII_REDACTED]0c500c  /data/app/com.whatsapp-2/lib/arm64/libwhatsapp.so
08-31 15:43:50.825  9720  9720 F DEBUG   :     #02 pc[PII_REDACTED]0c7d60  /data/app/com.whatsapp-2/lib/arm64/libwhatsapp.so
08-31 15:43:50.825  9720  9720 F DEBUG   :     #03 pc[PII_REDACTED]0f88d4  /data/app/com.whatsapp-2/lib/arm64/libwhatsapp.so
08-31 15:43:50.825  9720  9720 F DEBUG   :     #04 pc[PII_REDACTED]0f6948  /data/app/com.whatsapp-2/lib/arm64/libwhatsapp.so
08-31 15:43:50.825  9720  9720 F DEBUG   :     #05 pc[PII_REDACTED]0f0ef4  /data/app/com.whatsapp-2/lib/arm64/libwhatsapp.so
08-31 15:43:50.825  9720  9720 F DEBUG   :     #06 pc[PII_REDACTED]0f0630  /data/app/com.whatsapp-2/lib/arm64/libwhatsapp.so
08-31 15:43:50.825  9720  9720 F DEBUG   :     #07 pc[PII_REDACTED]0eef3c  /data/app/com.whatsapp-2/lib/arm64/libwhatsapp.so
08-31 15:43:50.825  9720  9720 F DEBUG   :     #08 pc[PII_REDACTED]1272e0  /data/app/com.whatsapp-2/lib/arm64/libwhatsapp.so
08-31 15:43:50.825  9720  9720 F DEBUG   :     #09 pc[PII_REDACTED]303d20  /data/app/com.whatsapp-2/lib/arm64/libwhatsapp.so
08-31 15:43:50.825  9720  9720 F DEBUG   :     #10 pc [PII_REDACTED]  /system/lib64/libc.so (_ZL15__pthread_startPv+208)
08-31 15:43:50.825  9720  9720 F DEBUG   :     #11 pc[PII_REDACTED]01da7c  /system/lib64/libc.so (__start_thread+16)

This issue can occur when a WhatsApp user accepts a call from a malicious peer. It affects both the Android and iPhone clients.

To reproduce the issue:

1) Apply the attached patch to libwhatsapp.so in the Android application using bsdiff. this patch intercepts a memcpy right before srtp_protect is called, and alters the RTP buffer. The SHA1 of the original library I used was cfdb0266cbd6877e5d146ddd59fa83ebccdd013d, and the SHA1 of the modified library is 042256f240367eaa4a096527d1afbeb56ab2eeb4.

2) Build the attached file, natalie2.c for the Android device the application is running on, and copy it to /data/data/com.whatsapp/libn.so.

3) Copy the files in the attached folder into /data/data/com.whatsapp/files so that /data/data/com.whatsapp/files/t0 is a valid location.

4) Restart WhatsApp and call the target device and pick up the call. The deivce will crash in a few seconds.

Logs from the crashes on Android and iPhone are attached. Note that I modified the Android target binary to disable WhatsApp's custom crash handling. The iPhone WhatsApp install was unmodified.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/45579.zip