Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Tools/GitHubGitHub/umvfx1bvaw50/cve-2017-13286
Android SecurityVulnerability AnalysisCode AnalysisExploitationMobile SecurityBinary Exploitation
GitHubumvfx1bvaw50/cve-2017-13286

CVE-2017-13286

CVE-2017-13286 Poc(can not use)

View Repository
122 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2017-13286

CVE-2017-13286 Poc(cannot use)

All resources are sourced from this article https://bbs.kanxue.com/thread-268506.htm

  • The main cause of this vulnerability is the inconsistency between reading and writing of Parcel objects. It can be traced back to the following code
root@kitploit:~
public void writeToParcel(Parcel dest, int flags) {
        if (dest == null) {
            throw new IllegalArgumentException("dest must not be null");
        }
        dest.writeInt(mRotation);
        dest.writeInt(mSurfaceGroupId);
        dest.writeInt(mSurfaceType);
        dest.writeInt(mConfiguredSize.getWidth());
        dest.writeInt(mConfiguredSize.getHeight());
        dest.writeInt(mIsDeferredConfig ? 1 : 0);
        dest.writeInt(mIsShared ? 1 : 0);
        dest.writeTypedList(mSurfaces);
}
 
private OutputConfiguration(@NonNull Parcel source) {
        int rotation = source.readInt();
        int surfaceSetId = source.readInt();
        int surfaceType = source.readInt();
        int width = source.readInt();
        int height = source.readInt();
        boolean isDeferred = source.readInt() == 1;
        // missing write mIsShared
        ArrayList<Surface> surfaces = new ArrayList<Surface>();
        source.readTypedList(surfaces, Surface.CREATOR);
 
        checkArgumentInRange(rotation, ROTATION_0, ROTATION_270, "Rotation constant");
        ...
        ...
        ...
}
  • It can be seen that in this version of AOSP, mIsShared is not read, but it is written

  • Using this, we can construct malicious Parcel serialization data to make the system execute something

  • The vulnerable code is located in the AOSP directory: frameworks/base/core/java/android/hardware/camera2/params/OutputConfiguration.java

  • Not only has this been fixed, but the current serialized object also adds more default elements

Download Tool