# 固件完整性漏洞总结 ## 漏洞概述 在固件更新过程中，存在固件完整性验证漏洞。具体位于 `platform_do_upgrade_cameo_dev()` 函数中，该函数通过 CRC32 进行固件完整性验证，但此验证机制容易被绕过。攻击者获取 CRC32 值后，可以构造带有相同 CRC32 值的恶意固件，从而绕过完整性验证，导致任意代码执行或服务拒绝。 ## 影响范围 - **受影响产品**：TEW-821DAP (固件版本 v1.12B01) ## 修复方案 - 页面未提供具体的修复方案。 ## POC代码 ```c static int platform_do_upgrade_cameo_dev(char *buffer, int len) { int firmware_hdr_addr; int backup_blockaddr; int backup_offset; int backup_size; int backup_addr; int firmware_size; int crc32; int i; if (len 0x1000000) return -1; backup_blockaddr = firmware_hdr_addr & ~0x100000; backup_offset = firmware_hdr_addr & 0x100000; backup_size = 0x100000 - backup_offset; backup_addr = backup_blockaddr + backup_offset; if (platform_do_upgrade_cameo_dev(backup_addr, backup_size) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_cameo_dev(firmware_hdr_addr + 0x100000, 0x100000) 0x1000000) return -1; if (platform_do_upgrade_c