search

fi01 / CVE-2015-3636

PoC code for 32 bit Android OS
131 stars 88 forks source link

Better success detection and handling #4

Closed jduck closed 9 years ago

jduck commented 9 years ago

Because get_sk_from_timestamp returns an int, successful attempts with sk addresses larger than 0x7fffffff are incorrectly ignored. Use an unsigned variable and propogate the result all the way back to main. We now stop on the first successfully replaced socket and don't spend time re-detecting. We surely created some invalid sockets, so we assume that is the case and always fork to preserve system stability.

fi01 commented 9 years ago

Thanks for your pull request!

sk addresses larger than 0x7fffffff are incorrectly ignored. Yes, it's a bug I don't realize.

But sorry, I can't merge your whole pull request. Because I want to close sockets as possible as I can. I think it is a goal that all sockets are closed completely, and it no longer crashes after exploit. I know many sockets are not closed yet though...

jduck commented 9 years ago

I can split the changes if you'd like. Trying to kill two birds with one stone =)

fi01 commented 9 years ago

Yes, please! I want to merge it with your credit.

And I don't like one commit for two birds. I want to log what it means.

jduck commented 9 years ago

Okay. Please review the reduced set of changes.