ServiceCheater

Poc of CVE-2020-0113 & CVE-2020-0108

Analysis of Android Foreground Service Privilege Escalation Vulnerability

Vulnerability Background

In the AOSP August 2020 patch, a vulnerability in the framework layer AMS was disclosed, numbered CVE-2020-0108, rated high, and another numbered CVE-2020-0313, rated medium. There is a logic vulnerability in the processing of foreground services in AMS. An attacker successfully exploiting this vulnerability can bypass the notification display of a foreground service and continue running in the background. The attack needs to be launched by a local malicious application and does not require user interaction. If the user grants other permissions to the application, it can cause greater harm, such as continuously tracking location or silently recording audio.

Foreground service is a concept introduced by Google in Android 8.0. Since Android 8.0 does not allow starting background services from the background, the concept of foreground service was designed. Foreground services have a higher priority and can run in the background for a long time, but a foreground service must bind a notification within 5 seconds of starting, otherwise it will be killed. In fact, the foreground service still runs in the "background", but because it is bound to a user-visible notification, Google calls it a "foreground service".

Vulnerability Details and Exploitation

• CVE-2020-0113

In the onNotificationError method of NotificationManagerService, exception conditions during notification display are not handled correctly. Since this method only calls the cancelNotification method to cancel the notification, without terminating the service or the entire application, the foreground service continues to run without displaying a notification.

cancelNotification(callingUid, callingPid, pkg, tag, id, 0, 0, false, userId,REASON_ERROR, null);}

• MalServiceA

When creating a RemoteViews object, the Layout ID is specified as -1, which is obviously an invalid value. This triggers the onNotificationError callback.

RemoteViews remoteViews = new RemoteViews(getPackageName(), -1);

• CVE-2020-0108

In the postNotification method of ServiceRecord.java, exception conditions during notification display are not handled correctly; instead, the exception is thrown to the user program.

ams.crashApplication(appUid, appPid, localPackageName, -1,
                        "Bad notification for startForeground: " + e);

• MalServiceB

Directly uses an invalid Channel ID to build the Notification.

Notification notification = new NotificationCompat.Builder(this, "InvalidInvalidInvalid")

The other two Services need to catch exceptions on the main thread, so the app does not crash.

Vulnerability Verification

• Environment

Genymotion emulator, Android 8.0, September 5, 2017 patch

• Background Audio Recording

Use MediaRecord to record audio for 10 seconds

• Update Geolocation

Obtained using LocationManager

• Comparison

A normal foreground service (NormalService) has a persistent notification in the notification bar, while the PoC does not have this notification.

Vulnerability Patch

In the onNotificationError callback, force the application to crash, and in the exception handling of the postNotification method, also force the application to crash.

References

[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0108

[2] https://github.com/wrlu/vulnerabilities/tree/master/CVE-2020-0108

[3] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0313