search

0xkol / badspin

Bad Spin: Android Binder Privilege Escalation Exploit (CVE-2022-20421)
MIT License
234 stars 32 forks source link

SYSCHK(epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &ev)); #11

Open hojeezila opened 1 year ago

hojeezila commented 1 year ago

what does this error means? SYSCHK(epoll_ctl(epfd, EPOLL_CTL_ADD, fd, &ev)); this error shows always when I try runing the code on Galaxy S21FE. @0xkol can you explain that to me? or suggest a solution?

0xkol commented 1 year ago

Try issue #5

hojeezila commented 1 year ago

Try issue #5

thank you. the problem solved. can you explain more about implementation of 512 offset error? you said in this #6 issue that the problem is some garbage value in this offset. I'd be grateful if you could explain this issue further . I am very interested to implement this offset for my poco x4 pro. I was wondering if you could clear up the solution for garbage value in this offset by providing more details?

0xkol commented 1 year ago

hi, good to hear that the problem solved. regarding your question - in the 512 offset there's the (obfuscated) slub freelist pointer. you can regard this value as "random" bits. currently, the exploit is taking advantage of the fact that freed memory is not initialized, i.e. the memory value there is 0x00000041, even after it has been freed. this assumption is true in all offsets, except 512, for reasons explained above. this assumption is not mandatory, just how i engineered the exploit. to fix it, you need to enter spin_lock() when the memory is still allocated, free it from another cpu (that's easy), and then fire the timer interrupt on the same cpu that spins. the last step is a bit more tricky, because you can't schedule the timer interrupt while the lock spins (i explained it in the white paper), but it is doable if you engineer the timings correctly. good luck and feel free to submit a pull request if you managed to get it working.