# Analysis of Tizen Security Model and Ways of Bypassing It on Smart TV Platform
## 5 Example of Attack Scenario
### Kernel Level Exploitation
#### 5.2.3 Execution of Kernel Exploit  
At this point, the setup is completed, and we can pass execution to our main function. Here, we check if we cached offsets for this specific device, and if not, we use kernel exploit to find them (Listing 10). We used CVE-2015-1805 as it can be used for an arbitrary read and write of kernel memory, allowing us to bypass kernel-level DEP. This bug exploits the incorrectly handled side effects of pipe_read ([[https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=637b58c2887e5e57850865839c75f59184b23d1](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=637b58c2887e5e57850865839c75f59184b23d1)]([https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=637b58c2887e5e57850865839c75f59184b23d1](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=637b58c2887e5e57850865839c75f59184b23d1)), accessed on 15 December 2021)/pipe_write ([[https://git.kernel.org/pub/scm/linux/kerne1/git/torvalds/linux.git/commit/?id=f0d1](https://git.kernel.org/pub/scm/linux/kerne1/git/torvalds/linux.git/commit/?id=f0d1) bec9d58d4c038d0 ac958c9 af82 bee6 eb18045]([https://git.kernel.org/pub/scm/linux/kerne1/git/torvalds/linux.git/commit/?id=f0d1](https://git.kernel.org/pub/scm/linux/kerne1/git/torvalds/linux.git/commit/?id=f0d1) bec9d58d4c038d0 ac958c9 af82 bee6 eb18045), accessed on 15 December 2021) APIs. Both of which are libc.so wrappers around kernel syscalls, which internally invoke pipe_iov_copy_to_user and pipe_iov_copy_from_user respectively. In case of failure those functions are executed once again on the same data in redo routine ([[https://elixir.bootlin.com/linux/v3.8/source/fs/pipe.cf#L533](https://elixir.bootlin.com/linux/v3.8/source/fs/pipe.cf#L533)]([https://elixir.bootlin.com/linux/v3.8/source/fs/pipe.cf#L533](https://elixir.bootlin.com/linux/v3.8/source/fs/pipe.cf#L533)), accessed on 15 December 2021) which results in possible _iovec_ array overrun. Combined with spraying of fake _iovec_ strcuts with _ivo_base_ set to kernel memory address this situation can be abused to achieve unauthorized read/write access to kernel memory [53]. We use this to dump kernel memory in 1 KiB chunks and locate all the necessary APIs. Once this step is completed, the exploited log looks something like this:```
Listing 10 Fragment of exploit log after localizing all necessary kernel symbols.
```
[+]Changingfdlimitfrom1024 to4096
[+]Gettingpipes:0
[+]Dumpingmemory
[+]Allocatingmemory
[+]Readingmemoryataddress:0 xc04a00000
[+]Startingmpd/ummapthread
[+]Startingreadthread:0
[+]Sprayingkernelheap
[+]Startingwritethread:0
[+]Dumped3 KiB
...
[+]Parsingkerneldump
[+]Foundexportstableat:0 xc04a68b4
[+]Processing8515 entriesfromexportstable...
[+]FoundI_BDEV:0 xc00 fd6f4
[+]Found_copy_from_user:0 xc01c97d4
[+]Found_copy_to_user:0 xc01c9c00
[+]Foundcommit_creds:0 xc005b84
[+]Foundelf_set_personality:0 xc0010a24
[+]Foundfinish_open:0 xc00c184
[+]Foundinit_task:0 xc051b340
[+]Foundmemest:0 xc01 cbcbc0
[+]Foundprepare_kernel_cred:0 xc0059370
[+]Foundstremp:0 xc01d4090
[+]Foundtry_module_get:0 xc007b464
[+]Foundcrypto_alg_sem:0 xc0526 lec
[+]Successfullyparsedkernel ```
Once we localize all the necessary kernel APIs, we proceed to the next part of the exploit. Firstly, we install __copy_from_user function as a syscall (Listing 11), which allows us to perform arbitrary writes into kernel memory without relying on a race condition from CVE-2015-1805, which makes the exploit much more stable. We need this because using CVE-2015-1805 is very slow, and it is often necessary to run it many times before it works.
```
[+]Parsingkerneldump
[+]Foundsyscalltableat:0 xc00111c4
[+]Successfullyparsedkernel
[+]Secondreadworked
[+]Allocatingmemory
[+]Installingcopy_from_usersyscall
[+]Patchingaddress0 xc001169 cwithvalue0 xc01c97d4
[+]Startingmpd/ummapthread
[+]Startingwritethread:0
[+]Sprayingkernelheap
[+]Startingreadthread:0
[+]Overflowvalue:0 xc01c97d4
[+]Done
[+]Firstwriteworked ```