Samsung Devices KNOX Extensions - OTP Service Heap Overflow

Samsung Devices KNOX Extensions - OTP Service Heap Overflow / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=935 As a part of the KNOX extensions available on Samsung devices, Samsung provides a new service which allows the generation of OTP tokens. The tokens themselves are...

Samsung Devices KNOX Extensions - OTP Service Heap Overflow

/ Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=935 As a part of the KNOX extensions available on Samsung devices, Samsung provides a new service which allows the generation of OTP tokens. The tokens themselves are generated in a TrustZone application within the TEE UID:...

Samsung Devices KNOX Extensions - OTP Service Heap Overflow Exploit

Exploit for Android platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=935 As a part of the KNOX extensions available on Samsung devices, Samsung provides a new service which allows the generation of OTP tokens. The tokens themselves are generated i...

Samsung Devices KNOX Extensions - OTP TrustZone Trustlet Stack Buffer Overflow

Samsung Devices KNOX Extensions - OTP TrustZone Trustlet Stack Buffer Overflow / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=938 As a part of the KNOX extensions available on Samsung devices, Samsung provides a TrustZone trustlet which allows the generation of OTP tokens. Th...

Google Android '/native/libs/binder/Parcel.cpp' Security Bypass Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A security bypass vulnerability exists in Google Android '/native/libs/binder/Parcel.cpp'. The vulnerability allows attackers to bypass certain security restrictions and perform...

Android kernel sensitive information leakage vulnerability (CNVD-2016-09566)

Android is an open source operating system based on Linux. A security vulnerability in Android's kernel Binder allows remote attackers to exploit the vulnerability to build malicious applications that can access sensitive information...

Google Android - Binder Generic ASLR Leak

Google Android - Binder Generic ASLR Leak Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=889 The interaction between the kernel /dev/binder and the usermode Parcel.cpp mean that when a binder object is passed as BINDERTYPEBINDER or BINDERTYPEWEAKBINDER, a pointer to that object...

Google Android - Binder Generic ASLR Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=889 The interaction between the kernel /dev/binder and the usermode Parcel.cpp mean that when a binder object is passed as BINDERTYPEBINDER or BINDERTYPEWEAKBINDER, a pointer to that object in the server process is leaked to the...

Android - Binder Generic ASLR Leak Vulnerability

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=889 The interaction between the kernel /dev/binder and the usermode Parcel.cpp mean that when a binder object is passed as BINDERTYPEBINDER or BINDERTYPEWEAKBINDER, a pointer to th...

CVE-2016-6689

Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30768347...

CVE-2016-6689

Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30768347...

Information disclosure

Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30768347...

UBUNTU-CVE-2016-6689

Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30768347...

Android - Insufficient Binder Message Verification Pointer Leak Vulnerability

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=860 When frameworks/native/libs/binder/Parcel.cpp reads e.g. a string from a parcel, it does not verify that the string doesn't overlap with any byte range that was tagged as a...

Google Android - Insufficient Binder Message Verification Pointer Leak

Google Android - Insufficient Binder Message Verification Pointer Leak Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=860 When frameworks/native/libs/binder/Parcel.cpp reads e.g. a string from a parcel, it does not verify that the string doesn't overlap with any byte range that...

Google Android - Insufficient Binder Message Verification Pointer Leak

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=860 When frameworks/native/libs/binder/Parcel.cpp reads e.g. a string from a parcel, it does not verify that the string doesn't overlap with any byte range that was tagged as a binder object by the sender. When an attacker sends a...

Google Android - getpidcon Usage binder Service Replacement Race Condition

Google Android - getpidcon Usage binder Service Replacement Race Condition Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=851 This is very similar to forshaw's bug , . The servicemanager, when determining whether the sender of a binder transaction is authorized to register a...

Android - getpidcon Usage binder Service Replacement Race Condition

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=851 This is very similar to forshaw's bug , . The servicemanager, when determining whether the sender of a binder transaction is authorized to register a service via...

Google Android - libutils UTF16 to UTF8 Conversion Heap Buffer Overflow

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=840 There's an inconsistency between the way that the two functions in libutils/Unicode.cpp handle invalid surrogate pairs in UTF16, resulting in a mismatch between the size calculated by utf16toutf8length and the number of bytes...

Return to libstagefright: exploiting libutils on Android

Posted by Mark Brand, Invalidator of Unic�o�d�e I’ve been investigating different fuzzing approaches on some Android devices recently, and this turned up the following rather interesting bug CVE 2016-3861 fixed in the most recent Android Security Bulletin, deep in the bowels of the usermode Andro...