-
Notifications
You must be signed in to change notification settings - Fork 272
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #100 from Fuzion24/feature/cve_2015_6616
- Loading branch information
Showing
3 changed files
with
102 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
76 changes: 76 additions & 0 deletions
76
...ain/java/fuzion24/device/vulnerability/vulnerabilities/framework/media/CVE_2015_6616.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,76 @@ | ||
| package fuzion24.device.vulnerability.vulnerabilities.framework.media; | ||
|
|
||
| import android.content.Context; | ||
|
|
||
| import java.io.ByteArrayOutputStream; | ||
| import java.io.File; | ||
| import java.io.FileInputStream; | ||
| import java.util.ArrayList; | ||
| import java.util.List; | ||
|
|
||
| import fuzion24.device.vulnerability.util.CPUArch; | ||
| import fuzion24.device.vulnerability.vulnerabilities.VulnerabilityTest; | ||
| import fuzion24.device.vulnerability.vulnerabilities.helper.BinaryAssets; | ||
| import fuzion24.device.vulnerability.vulnerabilities.helper.KMPMatch; | ||
|
|
||
| /** | ||
| * Created by fuzion24 on 12/14/15. | ||
| */ | ||
| public class CVE_2015_6616 implements VulnerabilityTest { | ||
|
|
||
| /* | ||
| CVE Bug(s) with AOSP links Severity Affected versions Date reported | ||
| CVE-2015-6616 | ||
| ANDROID-24630158 Critical 6.0 and below Google Internal | ||
| ANDROID-23882800 Critical 6.0 and below Google Internal | ||
| ANDROID-17769851 Critical 5.1 and below Google Internal | ||
| ANDROID-24441553 Critical 6.0 and below Sep 22, 2015 | ||
| ANDROID-24157524 Critical 6.0 Sep 08, 2015 | ||
| ANDROID-24630158 https://android.googlesource.com/platform%2Fframeworks%2Fav/+/77c185d5499d6174e7a97b3e1512994d3a803151 | ||
| ANDROID-23882800 https://android.googlesource.com/platform%2Fframeworks%2Fav/+/0d35dd2068d6422c3c77fb68f248cbabf3d0b10c | ||
| ANDROID-17769851 https://android.googlesource.com/platform%2Fframeworks%2Fav/+/dedaca6f04ac9f95fabe3b64d44cd1a2050f079e | ||
| ANDROID-24441553 https://android.googlesource.com/platform%2Fframeworks%2Fav/+/5d101298d8b0a78a1dc5bd26dbdada411f4ecd4d | ||
| ANDROID-24157524 https://android.googlesource.com/platform%2Fexternal%2Flibavc/+/2ee0c1bced131ffb06d1b430b08a202cd3a52005 | ||
| */ | ||
|
|
||
| @Override | ||
| public String getCVEorID() { | ||
| return "CVE-2015-6616"; | ||
| } | ||
|
|
||
| @Override | ||
| public boolean isVulnerable(Context context) throws Exception { | ||
| File stagefrightlib = new File("/system/lib/libstagefright.so"); | ||
| if(!stagefrightlib.exists() || !stagefrightlib.isFile()){ | ||
| throw new Exception("libstagefright.so doesn't exist or is not a file"); | ||
| } | ||
|
|
||
| ByteArrayOutputStream libStageFrightBAOS = new ByteArrayOutputStream((int)stagefrightlib.length()); | ||
| BinaryAssets.copy(new FileInputStream(stagefrightlib), libStageFrightBAOS); | ||
| byte[] libstagefrightSO = libStageFrightBAOS.toByteArray(); | ||
|
|
||
| KMPMatch binMatcher = new KMPMatch(); | ||
|
|
||
| int indexOf = binMatcher.indexOf(libstagefrightSO, "b/24445127".getBytes()); | ||
| boolean libstagefrightVulnerableToBug24445127 = indexOf == -1; | ||
|
|
||
| indexOf = binMatcher.indexOf(libstagefrightSO, "bogus max input size: %zu".getBytes()); | ||
| boolean libstagefrightVulnerableToBug17769851 = indexOf == -1; | ||
|
|
||
| indexOf = binMatcher.indexOf(libstagefrightSO, "b/24441553, b/24445122".getBytes()); | ||
| boolean libstagefrightVulnerableToBug24441553 = indexOf == -1; | ||
|
|
||
|
|
||
| return libstagefrightVulnerableToBug24445127 || | ||
| libstagefrightVulnerableToBug17769851 || | ||
| libstagefrightVulnerableToBug24441553; | ||
| } | ||
|
|
||
| @Override | ||
| public List<CPUArch> getSupportedArchitectures() { | ||
| List<CPUArch> archs = new ArrayList<>(); | ||
| archs.add(CPUArch.ALL); | ||
| return archs; | ||
| } | ||
| } |