关联漏洞
标题:Android 缓冲区错误漏洞 (CVE-2020-0022)Description:Android是美国谷歌（Google）和开放手持设备联盟（简称OHA）的一套以Linux为基础的开源操作系统。 Android中的packet_fragmenter.cc文件的‘reassemble_and_dispatch’函数存在缓冲区错误漏洞，该漏洞源于错误的边界计算。远程攻击者可利用该漏洞执行代码。以下产品及版本受到影响：Android 8.0版本，8.1版本，9版本，10版本。
Description
This is a RCE bluetooth vulnerability on Android 8.0 and 9.0
介绍
# Bluefrag_CVE-2020-0022
This is a RCE bluetooth vulnerability on Android 8.0 and 9.0
The test python scripts in the folder cve-2020-0022 are from https://insinuator.net/2020/04/cve-2020-0022-an-android-8-0-9-0-bluetooth-zero-click-rce-bluefrag/.
The original download hyperlink is https://insinuator.net/wp-content/uploads/2020/04/cve_2020_0022_export.tar-1.gz
Other crash script refers to https://cloud.tencent.com/developer/article/1590513 and https://github.com/leommxj/cve-2020-0022
Dive into the analysis and exploitation of BlueFrag CVE-2020-0022 for Android 8.0 and 9.0.
At the end of April 2020, insinuator posted their new research blog about a Bluetooth RCE vulnerability CVE-2020-0022 on Android 8.0 and 9.0. The author gave a detailed analysis and some details about how to exploit, as well as test python scripts. Regarding the exploit, the author didn’t reveal the ROP chain in his post, just left the reader to finish it alone. In this post, I provide a dive into the analysis of this bug, and detail the exploitation by step-by-step debugging. In the end, I implemented the full ROP chain with 5 ROP gadgets by myself to complete the full exploit. The demo video is attached.
NOTE: The full exploitation script will be released soon.
Here is the demo video "BlueFrag: CVE-2020-0022 RCE Exploit For Android 8.0 - 9.0" https://www.youtube.com/watch?v=o-rNRBqx7_k
文件快照
[4.0K] /data/pocs/b34f00363017480e0c035977f0eb6b1fd4121062
├── [4.0K] cve_2020_0022
│ ├── [ 17K] exploit.py
│ ├── [4.9K] fancy_leak.py
│ ├── [2.1K] memcpy.py
│ ├── [ 139] readme.txt
│ ├── [1.8K] simple_crash.py
│ └── [2.0K] simple_leak.py
├── [ 24M] cve-2020-0022_exploit_by_k3vinlusec.mp4
├── [4.1K] poc.c
└── [1.4K] README.md
1 directory, 9 files
备注
1. 建议优先通过来源进行访问。
2. 如果因为来源失效或无法访问，请发送邮件到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
3. 神龙已为您对 POC 代码进行快照，为了长期维护，请考虑为本地 POC 付费/捐赠，感谢您的支持。