yashsingh1/xdaforums huggingface dataset:
[Verizon Galaxy S 5 General] Stryke_the_Orc:
Let's keep this thread on topic please. The possible art exploit has been discussed and disproven.
[Verizon Galaxy S 5 General] open1your1eyes0:
Has anyone looked into CVE-2014-0196?

There seems to be a good chance we might still be affected by this security hole in the kernel which may possibly be used to gain elevated privileges.

EDIT: This is likely more linux-based than Android-based but might be worth a look at least.
[Verizon Galaxy S 5 General] :
Put me down for $20.00 to Verizon. I just got a S5 yesterday. It's a great phone and not having root wasn't a deal breaker for me but having root would be better.
[Verizon Galaxy S 5 General] designgears:
It is still there, but exploiting it would be a huge pain.
[Verizon Galaxy S 5 General] davidstre:
Put me down for $20.00 on Verizon. I am also willing to use my device for experimentation should that be of any help.
[Verizon Galaxy S 5 General] jeboo:
A PoC was just posted yesterday:

http://bugfuzz.com/stuff/cve-2014-0196-md.c
[Verizon Galaxy S 5 General] designgears:
That is interesting. Lets see if that works on android. :)

Edit:

tty: Halve flip buffer * GFP_ATOMIC memory consumption isn't patched on the latest kernel either.

edit:

certainly works on linux :)
[Verizon Galaxy S 5 General] cquick97:
How would one go about compiling this to run on android? I simply tried in Terminal IDE but of course it didnt work. Would cross compiling for arm work? Or do I have no idea what I'm talking about? Haha
[Verizon Galaxy S 5 General] clickclack333:
You would have to compile for arm yes. As it won't run anything else
[Verizon Galaxy S 5 General] cquick97:
I tried to compile the exploit (CVE-2014-0196) to run, and the exploit failed. I have very little knowledge of C, so it is quite possible there could be a small tweak someone could make that could cause it to work, or its even possible I compiled it wrong (although it actually runs so i doubt that is the problem).

I compiled with:

$arm-linux-gnueabi-gcc cve-2014-0196-md.c -lutil -lpthread -static -o exploit

Then, I pushed with:

$adb push exploit /data/local/tmp/exploit

Then, I ran

$adb shell
$cd /data/local/tmp
$./exploit

at which point it displayed:

shell@kltevzw:/data/local/tmp $ ./exploit
[+] Resolving symbols
[+] Resolved commit_creds: (nil)
[+] Resolved prepare_kernel_cred: (nil)
shell@kltevzw:/data/local/tmp $

If anyone else would like to look at this exploit with more knowledge about exploitation, please do! I just thought I'd share what I did, and what I know doesn't work. I hope I helped in at least some minor way :)
[Verizon Galaxy S 5 General] designgears:
[+] Resolved commit_creds: (nil)

[+] Resolved prepare_kernel_cred: (nil)

Can't do that without root (says some very knowledgeable person)
[Verizon Galaxy S 5 General] cquick97:
Are you trying to say we need root to run a privilege escelation exploit to get root..?
[Verizon Galaxy S 5 General] designgears:
Yup :good:
[Verizon Galaxy S 5 General] cquick97:
I'm confused then...
[Verizon Galaxy S 5 General] jeboo:
You'd have to fill in the addresses manually. The author mentioned it's for 64-bit kernels btw.
[Verizon Galaxy S 5 General] cquick97:
So, is it possible or just a dead end?
[Verizon Galaxy S 5 General] Surge1223:
Well its not a dead end, just difficult.

You can find the addresses you need to define by searching through kallsyms.
[Verizon Galaxy S 5 General] designgears:
You won't get it from kallsyms

T commit_creds.00000000

T prepare_kernel_cred.00000000

That is why it returns nil
[Verizon Galaxy S 5 General] Add45:
Fine I'll ask... what is with the .00000000 ?

Shouldn't there be a method there?
[Verizon Galaxy S 5 General] jeboo:
This goes back to: http://insitusec.blogspot.com/2013/01/kallsyms-on-android.html

You could derive the addresses by either scanning memory or in IDA using expected code/signature. I tried the exploit on my s4, didn't work.
[Verizon Galaxy S 5 General] Surge1223:
If someone with a rooted dev edition flashed the retail kernel and got the kallsyms you would have the addresses. Also System.map and using objdump after compiling the kernel would help narrow the ranges at the least.
[Verizon Galaxy S 5 General] jacklex13:
Don't have much but I'm in for $30 At&t
[Verizon Galaxy S 5 General] dlscott1111:
Pledge

$10 for Verizon Root. Don't have the phone but I'm all for Stickin it to the Man!!
[Verizon Galaxy S 5 General] BigBot96:
I posted the kallsyms here: http://xdaforums.com/showthread.php?t=2741408

Over a week ago. You don't need root if you have the firmware and a Linux box.
[Verizon Galaxy S 5 General] jeboo:
Nice.

So you can make the following changes to the exploit src and try it for the VZW S5:

// commit_creds = (commit_creds_fn)get_symbol("commit_creds");
// prepare_kernel_cred = (prepare_kernel_cred_fn)get_symbol("prepare_kernel_cred");
commit_creds = (commit_creds_fn)0xc01b8770;
prepare_kernel_cred = (prepare_kernel_cred_fn)0xc01b8ca8;
[Verizon Galaxy S 5 General] clickclack333:
If this works We have root correct?
[Verizon Galaxy S 5 General] cquick97:
When I get home in an hour or so I will try this, assuming no one else has before then. It looks promising!
[Verizon Galaxy S 5 General] cquick97:
Just kidding, I had a few minnutes to try it. I only edited that so if there is more to do I don't know. But this is the output:

Seems to be a bit further! Any ideas?
[Verizon Galaxy S 5 General] BigBot96:
I'll give it a try myself in a bit.
[Verizon Galaxy S 5 General] open1your1eyes0:
FYI guys, if /data/local/tmp directory is not working for you, try formatting a microSD card as exFAT, putting the exploit on the root of the microSD card, and running the same exploit in /mnt/extSdCard.

We used this in the past with the Verizon Galaxy S4 as for some odd reason the usual /data/local/tmp directory was not working properly (Example).
[Verizon Galaxy S 5 General] designgears:
Very odd, checking it out.
[Verizon Galaxy S 5 General] cquick97:
I'll try that right now, give me a few...
[Verizon Galaxy S 5 General] owenbeals:
So we will have to get our hands on an sdcard for this method?
[Verizon Galaxy S 5 General] open1your1eyes0:
The exploit is not confirmed working yet. The microSD card directory is just another possibility to test in case there is some block on the /data/local/tmp directory (as was on the S4).
[Verizon Galaxy S 5 General] cquick97:
Permission denied when trying to execute from /mnt/extSdCard. Unless I'm doing something wrong. I just adb pushed then ran with adb shell
[Verizon Galaxy S 5 General] Razzzzer:
isn't this why threads get closed and why its hard to find info when searching in a thread for info pertaining to the title/OP? just saying. ;)
[Verizon Galaxy S 5 General] designgears:
Same deal here, can't chmod either, obviously.
[Verizon Galaxy S 5 General] open1your1eyes0:
You will get this message if your microSD card is not formatted as exFAT (at least this was the case on the S4).

Either that, or the S5 may have now blocked this directory (due to external storage changes in KitKat or Samsung's own blocks).
[Verizon Galaxy S 5 General] cquick97:
I can't really see how my post falls outside of this list.

I know mine is exFAT, but I can try reformating again. If I format from the phone what filesystem would it give it?

Edit: Still didn't work. Tried reformating with exFAT, same message. Any other directories to try?
[Verizon Galaxy S 5 General] BigBot96:
Put it in /data/local/tmp

then: toolbox chmod 777 filename

then: ./filename

That should let you run it
[Verizon Galaxy S 5 General] eragon5779:
Pty creation failed again.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] BigBot96:
How did you compile it? I've never compiled C for arm before and I'm having issues. compiling it I keep getting these warnings:

/tmp/ccnEVpwU.o: In function `main':
suckit.c:(.text+0x306): undefined reference to `openpty'
suckit.c:(.text+0x3ae): undefined reference to `openpty'
suckit.c:(.text+0x40a): undefined reference to `openpty'
suckit.c:(.text+0x4d4): undefined reference to `pthread_create'
suckit.c:(.text+0x518): undefined reference to `pthread_join'
[Verizon Galaxy S 5 General] eragon5779:
Look back a few pages. Someone explained. Around page 44

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] BigBot96:
I did that and get the above errors..
[Verizon Galaxy S 5 General] eragon5779:
What do you put into the terminal?

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] cquick97:
I'll show you how I compiled it when I get back to my computer
[Verizon Galaxy S 5 General] jeboo:
I used the latest Linaro build from this thread to compile:

http://xdaforums.com/showthread.php?t=2098133
[Verizon Galaxy S 5 General] BigBot96:
$arm-linux-gnueabi-gcc -lutil -lpthread -static suckit.c -o suckit
[Verizon Galaxy S 5 General] eragon5779:
Should've worked. Not sure what's wrong

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] cquick97:
This is exactly what I do.
[Verizon Galaxy S 5 General] DroidHam:
Coming to the Verizon S5 tomorrow from my S3; I'm catching up on the threads now but it looks like we've got a ways to go for the root, correct? How bad is stock?
[Verizon Galaxy S 5 General] d0ppler302:
So should I stay up all night now? I'll help testing the exploit if needed
[Verizon Galaxy S 5 General] eragon5779:
Me too. I will dedicate my night to testing this exploit thoroughly.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] kuronosan:
Count me in as well.
[Verizon Galaxy S 5 General] clickclack333:
Another tester here. Excited root is a possibility.
[Verizon Galaxy S 5 General] eragon5779:
If someone can figure out how to get the last 3 steps of the process to work for that method, we would have root

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] cquick97:
Does this have anything to do with it not working? Is the kernel too old for this exploit to work? The vulnerability would still be there but only kernels >= v3.14-rc1 would use THIS exploit?
[Verizon Galaxy S 5 General] sgtcasey:
I'm here and willing to test if it doesn't break the phone and I can get step by step directions.

[Edit] I just tried compiling the poc file and it failed. It doesn't help that I'm on Windows 8. If I was more versed in Linux and such I'd tinker with this some more but I'll just wait for those more knowledgeable in all this to come up with a plan.
[Verizon Galaxy S 5 General] Justindail311:
Where are you guys getting the files? I can test now or even take a Crack at it myself since finals are over now.
[Verizon Galaxy S 5 General] BigBot96:
All I've read on it states "Linux kernel through 3.14.3". More than likely our kernel, being 3.4, is patched. It's worth more exploration, but chances are it's gone.
[Verizon Galaxy S 5 General] cquick97:
3.14 comes much after 3.4. Think of it as 4<14. That's how the kernel versions are numbered

---------- Post added at 10:48 PM ---------- Previous post was at 10:31 PM ----------

Just Google cve-2014-0196 and look for the exploit. I don't have the site right now. But it will be a C file, compile it for arm (see above posts to do that) and push to /data/local/tmp. Try to mess with the code. Kallsyms was posted a ways back too.
[Verizon Galaxy S 5 General] BigBot96:
Ya don't say? And it took this long for someone to correct me (not just here but elsewhere too..). Thanks for that. Good to know.
[Verizon Galaxy S 5 General] Justindail311:
Alright I will get on it. I've been needing something to play with.
[Verizon Galaxy S 5 General] Franzie3:
Count me in to test. By chance has anyone taken this into the IRC webchat. I know this is technically within the guidelines of bounty thread but it might be easier to talk it over in IRC
[Verizon Galaxy S 5 General] KaM1KaZ3:
Count me in for testing???? geting on it
[Verizon Galaxy S 5 General] renofreak:
I pledge $20
[Verizon Galaxy S 5 General] Justindail311:
Anyone tried compiling for hard floats that new devices use?
[Verizon Galaxy S 5 General] edgtv:
Put me in for 20$ on Verizon
[Verizon Galaxy S 5 General] designgears:
It's not patched.. yet

It's also failing long before it gets to that anyways.

puts("[+] Doing once-off allocations");

for (i = 0; i < ONEOFF_ALLOCS; ++i)
[COLOR="Red"][B]if (openpty(&temp_fd_1, &temp_fd_2, NULL, NULL, NULL) == -1) {[/B][/COLOR]
puts("[-] pty creation failed");
return 1;
}

Either it works differently on android or we can't create one, if we can't create new ones, well, dead end.
[Verizon Galaxy S 5 General] mobius378:
Put me down for 20 root verizon
[Verizon Galaxy S 5 General] cquick97:
I'm not saying its been patched, but that since the kernel is so old, the vulnerability may not even have been introduced yet, since he says this exploit relies on a recent commit that makes it easier to exploit (ie: 3.14rc1). I'm not saying the whole vulnerability itself isn't there, but maybe we need a different exploit since we wouldn't have that recent commit that the exploit we are trying relies on.

I'll look more into where/why it is failing before then though.
[Verizon Galaxy S 5 General] moah9998:
Okay so I'm not to sure about this but for what I have read here you all have a exploit that is for the 3.4 kernal and for what I have read also Verizon has the 3.14 kernel? Well the att varient has the 3.4 kernel or at least mine does so could this be a working version for the attached version? I'm not saying I have all the info about this but for what I've read this could work.
[Verizon Galaxy S 5 General] kprice8:
My Verizon S5 info

Sent from the S5 with FoxFi freedom
[Verizon Galaxy S 5 General] moah9998:
Okay so maybe I was wrong about it having the 3.14 so I guess I'm now confused about all that but here is the att variant info if this helps and if there is a exploit that could work for this I'm willing to test it.
[Verizon Galaxy S 5 General] eragon5779:
Could the 0xfff value be causing it?

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] designgears:
Wrong place. It is failing just after line 147.
[Verizon Galaxy S 5 General] eragon5779:
Okay. My mistake.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] cquick97:
The S5, both Verizon and at&t both have kernel 3.4. The linux kernal that introduces this particular vulnerability is 3.14. We have an earlier kernel, which I'm not sure has the vulnerability used in this exploit. There was a recent change to the Linux kernal that made the vulnerability easier to exploit, which we are trying to utilize, but I'm not sure we have that recent change since our kernel is older...
[Verizon Galaxy S 5 General] spuniun:
This POC is limited to above 3.14-rc1 (when commit acc0f67f307f52f7aec1cffdc40a786c15dd21d9 is introduced) and below 3.15-rc4 (where the exploit is patched).

We would need a different approach to take advantage of the exploit as far as I can tell.

EDIT:

The exploit exists as early as 2.6.31-rc3 but the method in which this POC invokes the exploit is limited to >3.14-rc1.

Our kernel is still susceptible, just needs a different approach.
[Verizon Galaxy S 5 General] kprice8:
If I am not mistaken, someone was saying last night that 3.4 is newer than 3.14, or is this what you were trying to say?
[Verizon Galaxy S 5 General] spuniun:
Other way around. 4 < 14
[Verizon Galaxy S 5 General] eragon5779:
3.4 is older than 3.14. It goes in order, e.g. 3.1, 3.2,...,3.9, 3.10, 3.11, etc.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] kprice8:
Thanks Spun and Eragon, I was so tired last night reading through the forums, I became a bit dyslexic about the numbers this morning. Apologies.
[Verizon Galaxy S 5 General] cquick97:
4 is before 14.

http://en.wikipedia.org/wiki/Linux_Kernel#Maintenance

3.4 released in may 2012, 3.14 released march 2014
[Verizon Galaxy S 5 General] eragon5779:
Anyways. Does anyone have a way to exploit this on the 3.4 kernel? It sounds like it is possible, just very difficult to do.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] cquick97:
Since the exploit we've been trying doesn't sound like it will work, we would need someone to develop an exploit without the new POC. (Something I have no clue how to do...) Unless there is an exploit already out there that we haven't found yet.
[Verizon Galaxy S 5 General] RockyCJC:
Makes you wonder if Samsung, Att, and Verizon all knew this already and figured that the exploit could not be brought to the surface so they left it there to keep devs occupied.
[Verizon Galaxy S 5 General] Dennisg34:
Not trying to change topics, just confused. Coming from a math standpoint, 3.4 comes before 3.14?
[Verizon Galaxy S 5 General] kenkamm:
Think of it as a counter, not a quantity. The "." is a dot, not a decimal point.
[Verizon Galaxy S 5 General] spuniun:
They had no idea - this exploit was very recently made public.
[Verizon Galaxy S 5 General] eragon5779:
Yep. And it should work on the 3.4.0 kernel, just a little differently. And Verizon and AT&T should take a while to patch it.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] spuniun:
I also just realized that the only POC for this exploit (so far) targets x64 kernels only. Someone with much skill will need to figure out how to implement for ARM v3.4 cause this POC is a dead end.
[Verizon Galaxy S 5 General] BigBot96:
I was treating it as a decimal also.. which doesn't even make sense on my part. (there's a reason I'm a system admin and not a software engineer) Thanks for the info again. :good:

Back on topic: Since this bounty is for both VZW & ATT, do we know the symbols will be the same for the AT&T guys? If there's a chance they won't be the same, can somebody send me a DL for the AT&T kernel? I can extract the kallsyms and see if they're the same. If not, I'll post it in my INFO thread.
[Verizon Galaxy S 5 General] xkwr27:
I recently aquire an s5. I have read through looked at the exploit you are working on, would this http://blog.zx2c4.com/749 be of any use... I'm at work atm but when I get home in 7 hrs or so I am going to play with this guy's source, see if I can compile it for arm other than that I have weak android development skills but can be useful when I put my grey hat on, and I'll be available to help test Friday night Saturday day, and Monday night through Thursday morning almost continuously.
[Verizon Galaxy S 5 General] cquick97:
This is definitely a huge stepping stone though, and a good path going forward. The exploit works, and the vulnerability is present in our kernel. We just need somebody with the knowledge of ARM architecture and exploit development to take over. I know none of that...
[Verizon Galaxy S 5 General] eragon5779:
Reading through the article, it was fixed already. Not sure if we can apply it to the cve-2014-0196

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] cquick97:
This was patched back in 3.2

P.S. Do we have some sort of IRC room we can talk? It would be way easier than the forum.
[Verizon Galaxy S 5 General] byte9:
Everybody has been in freenode #sgs5

Love, from GS5 locked bootloader hell.
[Verizon Galaxy S 5 General] xkwr27:
They said it was patched but not at way version.
[Verizon Galaxy S 5 General] spuniun:
It was patched a long time ago and not exploitable on our devices.
[Verizon Galaxy S 5 General] eragon5779:
I emailed the guy who helped with the POC. Seeing if he will respond with advice.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] tmchouse:
Put me down for $100 for the Verizon S5.

Thanks to all who are working this challenge.
[Verizon Galaxy S 5 General] owenbeals:
Any word yet?
[Verizon Galaxy S 5 General] eragon5779:
Nothing.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] EnigmaKustomz:
I'll add $50 for AT&T
[Verizon Galaxy S 5 General] renofreak:
ROCK AND ROLL GUYS. We all appreciate everything you're doing!
[Verizon Galaxy S 5 General] eragon5779:
Still no reply. Sent the email at 2 pm MST. For those interested, I sent an email to the two people listed in the PoC. If anyone has a quicker way to get ahold of them, feel free to do so.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] dodendemise:
$50 for Verizon... *fingers crossed *
[Verizon Galaxy S 5 General] az-dave:
My prior Pledge: $35 - ATT. My New Pledge if Root is achieved PRIOR to me buying outright TMBL phone: $70

I spent about 12 solid hours attempting a REALLY round-bout way to Access root on the S5. - in the process broke my rooted, running for more than 1-year S3 trying to do some trick USB links to my S5 thru Ubuntu, found a potential way in to root system on the S5 via a root mirror on the S3, and bricked the S3 making my ability to access S5 via S3 impossible. So now I wont even attempt the same thing on the S5 since I NEED it for phone calls for work.

I cant use Maps the WAY I NEED TO, thus I need root to change the App. Period.

If Root is not found soon for ATT/VZN S5, then I think there may be a "Weeeeeee" bit of a problem for the future potential of Non-corp Dev's on ALL devices from this day forward...and that might be just a little bitty important for great sites like XDA (who has saved my a$$ a few times) going forward...if not for root...then what?

Knowing the TM phone works on ATT 4G LTE network, im willing to PAY $$$ to sell this brick of an S5 to get one I can actually CUSTOMIZE. anymore than $70 pledge, and I may as well go the long route. Sell this one and buy TM and re-setup everything.
[Verizon Galaxy S 5 General] ks3rv3rg:
What carrier do you use? From your comments it seems like you are saying you have att & verizon.
[Verizon Galaxy S 5 General] eragon5779:
He replied.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] eragon5779:
Sent him the strace.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] cquick97:
Just wanted to make sure, I had posted one earlier that was just 3 lines, not sure if you got that one or the later longer one. Just making sure you have the right one :P
[Verizon Galaxy S 5 General] spuniun:
Better yet, make sure he knows there's a $12k bounty for finding the right direction.

Reading up on the openpty function in use in that POC, it seems that it would depend on our ability to either remount /dev/pts with proper permissions as the default is insufficient

devpts /dev/pts devpts rw,seclabel,relatime,mode=600 0 0

(which is not possible without root), modify the SElinux policy of it (which is also not possible without root), or use a modified openpty function that ignores the chmod errors and see if that works (which is above my pay grade).

However, I still think it's a wasted effort as this all assumes that the "Halve flip buffer GFP_ATOMIC memory consumption" patch exists which we have good reason to believe it does not in our kernel. I think we still need someone to take a look at the much smaller attack surface of this exploit for older kernels such as ours.
[Verizon Galaxy S 5 General] az-dave:
I have a Ubuntu 12.04.02 Linux terminal and a Win 7 Terminal, 2 screens side by side (2 different 'puters' running at same time on same network). If anyone likes, I can attempt to compile and tweak without some of these source files and also test out on my S5 (I honestly dont care if it breaks at this point). PM me if anyone wants.
[Verizon Galaxy S 5 General] kprice8:
Why not PM the devs that have been commenting on here and see if you can help them! Any extra hands on deck I am sure would be helpful!
[Verizon Galaxy S 5 General] eortizr:
if this exploit would really work for root it had been done days ago by any of the seasoned Devs in XDA, I mean common there is a 12K bounty.
[Verizon Galaxy S 5 General] eragon5779:
It will work. Its just a matter of figuring out how to get it to work. It isn't patched on our phones, but its harder to get to on the kernel we are on since it is a little older.

Sent from my white SM G900V on XDA Premium 4
[Verizon Galaxy S 5 General] toren98:
This might be a stupid question... But what about creating a function in the kernel using its own global variables to plug in the exploit?

EDIT: My bad, I didn't see pg. 54 until now.