📖 About the Project

This repository contains an in-depth technical analysis of CVE-2025-21082, a critical Use-After-Free (UAF) vulnerability discovered in the Xiaomi HyperOS AVCodec media processing framework, along with a simulation of the attack mechanism and mitigation recommendations.

The root cause of the vulnerability is that the codec context is freed in the AVCodec's asynchronous callback mechanism while worker threads are still running. This leads to a classic Use-After-Free race condition and theoretically provides the possibility of Remote Code Execution (RCE).

The project includes a safe UAF simulation written in Rust, comprehensive technical documentation, GitHub Actions CI pipeline automation, and a browser-based interactive visualization.

---

📂 Repository Structure

HyperOS-Directory-Traversal-Analysis/
│
├── 📁 .github/                     # GitHub community and CI/CD workflows
│   ├── 📁 ISSUE_TEMPLATE/          # Bug and feature request templates
│   │   ├── 📄 config.yml           # Issue template configuration and links
│   │   ├── 📄 hata-raporu.yml      # Bug report form (YAML Forms)
│   │   └── 📄 ozellik-istegi.yml   # Feature request form (YAML Forms)
│   ├── 📁 workflows/
│   │   ├── 📄 rust.yml             # Rust CI — Build, test and lint pipeline
│   │   ├── 📄 pages.yml            # GitHub Pages automatic publishing
│   │   ├── 📄 security.yml         # Security scan (cargo-audit, CodeQL)
│   │   └── 📄 docs.yml             # Documentation lint and link check
│   ├── 📄 dependabot.yml           # Automatic dependency updates
│   ├── 📄 FUNDING.yml              # GitHub Sponsors configuration
│   ├── 📄 mlc_config.json          # Markdown link checker settings
│   ├── 📄 PULL_REQUEST_TEMPLATE.md
│   └── 📄 SECURITY.md              # Security policy
│
├── 📁 assets/                      # Logo and image files
│   └── 🖼️ isu-logo.png             # İstinye University logo
│
│
├── 📁 docs/                        # Technical documentation
│   ├── 📄 zafiyet-analizi.md       # Vulnerability analysis and CVSS scoring
│   ├── 📄 mimari-analiz.md         # HyperOS AVCodec architecture diagram
│   ├── 📄 cozum-onerileri.md       # Mitigation recommendations and C++ patches
│   └── 📄 README.md                # Documentation guide index
│
├── 📁 research_results/            # Assignment research results
│   ├── 📄 Cevaplarım.md            # Answers to 10 advanced questions
│   ├── 📄 SORULAR.md               # Assignment questions
│   ├── 📄 yorum.md                 # Personal analysis and commentary
│   ├── 📄 simple.md                # Simple explanations (50 steps)
│   ├── 🌐 infographic.html         # Visual vulnerability guide
│   └── 📄 README.md                # Research results index
│
├── 📁 poc_python/                  # Python analysis tools (Reference)
│   ├── 📄 exploit.py               # CVE-2025-2844 Directory Traversal PoC
│   └── 📄 requirements.txt
│
├── 📁 poc_rust/                    # Rust UAF simulation (Main PoC)
│   ├── 📁 src/
│   │   └── 📄 main.rs              # Unsafe Rust UAF simulation logic
│   └── 📄 Cargo.toml
│
├── 🌐 simulation.html              # Interactive web simulation panel (5 scenes)
├── 📄 README.md                    # This file
├── 📄 CODE_OF_CONDUCT.md           # Community code of conduct
├── 📄 CONTRIBUTING.md              # Contribution guide
├── 📄 TODO.md                      # Task tracking list
└── ⚖️  LICENSE                      # MIT License

---

🧠 Vulnerability Summary

Feature	Detail
CVE Number	CVE-2025-21082
Vulnerability Type	Use-After-Free (CWE-416)
Affected Component	Xiaomi HyperOS AVCodec Framework
CVSS v3.1 Score	8.1 (High)
Attack Vector	Network
Impact	Remote Code Execution (RCE) potential
Discovery Date	10 February 2025
Patch Date	20 February 2025

Root Cause of the Vulnerability

[Main Thread]    processFrameAsync() → Worker thread started
                      ↓
                release() called → Memory FREED ⚠️
                      ↓
[Worker Thread] Continues to access freed memory → UAF 💥

---

🎬 Demo

You can watch the screen recording below showing the compilation, execution, and Use-After-Free simulation output of the project:

---

🚀 Quick Start

Requirements

• Rust 1.70 or later → rustup.rs
• Python 3.8 or later
• A modern web browser (Chrome, Firefox, Edge)

1. Rust PoC — UAF Simulation

# Clone the project
git clone https://github.com/kkaanozturk/HyperOS-Directory-Traversal-Analysis.git
cd HyperOS-Directory-Traversal-Analysis/poc_rust

# Compile in release mode
cargo build --release

🔴 Vulnerable Scenario (Race Condition & UAF Demonstration)

# Windows
.\target\release\cve_2025_21082_uaf_poc.exe --mode vulnerable --verbose

# Linux / macOS
./target/release/cve_2025_21082_uaf_poc --mode vulnerable --verbose

Expected Output:

🔬 CVE-2025-21082: HyperOS AVCodec UAF PoC
Mode: vulnerable

⚠️  Running vulnerable scenario...
CodecContext allocated in Arc<Mutex<T>>
🧵 Starting worker thread...
🗑️  Main thread releasing codec context (UAF trigger)...
Memory corrupted to simulate UAF
🔄 Worker thread accessing codec context...
🚨 UAF detected! Magic number corrupted: 0xFEEDFACE
💥 UAF vulnerability triggered on frame 0!

🚨 Vulnerable scenario completed - UAF demonstrated!
⚠️  In a real exploit, this could lead to RCE

🟢 Patched Scenario (Safe Synchronization)

# Windows
.\target\release\cve_2025_21082_uaf_poc.exe --mode patched --verbose

# Linux / macOS
./target/release/cve_2025_21082_uaf_poc --mode patched --verbose

Expected Output:

🔬 CVE-2025-21082: HyperOS AVCodec UAF PoC
Mode: patched