android CVE 漏洞汇总

时间:2023-12-05 18:54:26

arm exploits 技术教程:

Learning Pentesting for Android Devices

CVE-2015-1530 ,CVE-2015-1474 两个android整数溢出漏洞 分析

An integer overflow in Android media could be exploited to get media_server permission(CVE-2015-1530)

Integer overflow leading to heap corruption while unflattening GraphicBuffer In Android(CVE-2015-1474)

CVE-2014-0196-inux pty race condition slab overflow-漏洞分析

Exploiting CVE-2014-0196 a walk-through of the Linux pty race condition PoC

SLAB 溢出攻击 & CVE-2014-0196 exploit for Android

http://www.phrack.org/issues/64/6.html

pty/tty设备竞争条件漏洞 (CVE-2014-0196)

CVE-2013-2597 adcb 驱动栈溢出漏洞分析

Stack-based buffer overflow in acdb audio driver (CVE-2013-2597)

Stack-based buffer overflow in acdb audio driver (CVE-2013-2597)

这份利用代码关键是要理解 struct nl_portid_hash 结构的成员  unsigned long  rehash_time; 利用的时候将这个 unsigned long 变量当作  void* 函数指针来用,这样call 到 nl_portid_hash ->rehash_time 时pc寄存器装入 rehash_time 的值,而

在linux系统上,这个rehash_time变量的值是有范围的,其范围 0x10000-0x130000 ,如果当作地址,刚好是用户空间的地址,可以由mmap申请。这样,可以将提取代码写入申请的 0x10000-0x130000 范围地址内,内核溢出后调用 rehash_time  地址,实际上就是调用到用户空间填充的代码了

linux kernel 本地提权漏洞CVE-2013-1763 exploit 代码分析