CVE-2017-13286

CVE-2017-13286 Poc(cannot use)

All resources are sourced from this article https://bbs.kanxue.com/thread-268506.htm

• The main cause of this vulnerability is the inconsistency between reading and writing of Parcel objects. It can be traced back to the following code

public void writeToParcel(Parcel dest, int flags) {
        if (dest == null) {
            throw new IllegalArgumentException("dest must not be null");
        }
        dest.writeInt(mRotation);
        dest.writeInt(mSurfaceGroupId);
        dest.writeInt(mSurfaceType);
        dest.writeInt(mConfiguredSize.getWidth());
        dest.writeInt(mConfiguredSize.getHeight());
        dest.writeInt(mIsDeferredConfig ? 1 : 0);
        dest.writeInt(mIsShared ? 1 : 0);
        dest.writeTypedList(mSurfaces);
}
 
private OutputConfiguration(@NonNull Parcel source) {
        int rotation = source.readInt();
        int surfaceSetId = source.readInt();
        int surfaceType = source.readInt();
        int width = source.readInt();
        int height = source.readInt();
        boolean isDeferred = source.readInt() == 1;
        // missing write mIsShared
        ArrayList<Surface> surfaces = new ArrayList<Surface>();
        source.readTypedList(surfaces, Surface.CREATOR);
 
        checkArgumentInRange(rotation, ROTATION_0, ROTATION_270, "Rotation constant");
        ...
        ...
        ...
}

• It can be seen that in this version of AOSP, mIsShared is not read, but it is written

• Using this, we can construct malicious Parcel serialization data to make the system execute something

• The vulnerable code is located in the AOSP directory: frameworks/base/core/java/android/hardware/camera2/params/OutputConfiguration.java

• Not only has this been fixed, but the current serialized object also adds more default elements