
CVE-2017-13286 Poc(can not use)
CVE-2017-13286 Poc(cannot use)
All resources are sourced from this article https://bbs.kanxue.com/thread-268506.htm
public void writeToParcel(Parcel dest, int flags) {
if (dest == null) {
throw new IllegalArgumentException("dest must not be null");
}
dest.writeInt(mRotation);
dest.writeInt(mSurfaceGroupId);
dest.writeInt(mSurfaceType);
dest.writeInt(mConfiguredSize.getWidth());
dest.writeInt(mConfiguredSize.getHeight());
dest.writeInt(mIsDeferredConfig ? 1 : 0);
dest.writeInt(mIsShared ? 1 : 0);
dest.writeTypedList(mSurfaces);
}
private OutputConfiguration(@NonNull Parcel source) {
int rotation = source.readInt();
int surfaceSetId = source.readInt();
int surfaceType = source.readInt();
int width = source.readInt();
int height = source.readInt();
boolean isDeferred = source.readInt() == 1;
// missing write mIsShared
ArrayList<Surface> surfaces = new ArrayList<Surface>();
source.readTypedList(surfaces, Surface.CREATOR);
checkArgumentInRange(rotation, ROTATION_0, ROTATION_270, "Rotation constant");
...
...
...
}
It can be seen that in this version of AOSP, mIsShared is not read, but it is written
Using this, we can construct malicious Parcel serialization data to make the system execute something
The vulnerable code is located in the AOSP directory: frameworks/base/core/java/android/hardware/camera2/params/OutputConfiguration.java
Not only has this been fixed, but the current serialized object also adds more default elements