android projects with source code in android studio github

Inputs for which a deparcel -> parcel -> deparcel round trip results in an

enumerate all the Parcelable types, then use fuzzing to find serialized.

Serialization/deserialization, then manually look at all of them

use static analysis to find Parcelable types with nontrivial.

Possible approaches to find variants would be: Part of an exploit chain? The Next Steps Variant analysisĪreas/approach for variant analysis (and why): (The terms exploit primitive, exploit strategy, exploit technique, and exploit flow are defined here.) This type of vulnerability is favored by PDDs because of the low threshold for stability of exploitation and The bug was also using other issues of the same bug class:Īmong them, SonaAbility is the core of the whole system, which is packed with several 0day and 1dayīundle Mismatch vulnerabilities of various platforms for privilege escalation.

The davinci1012/davincifans101 writeup says that the malicious app that abused Or type-value-length encoding are much less susceptible to such issues. Other serialization schemes that rely on code generation from schema definitions (typically written in Java), and if there is a mismatch between these, that's Type that can be serialized has custom code for serialization/deserialization (Historical/present/future) context of bug:Īndroid's Parcel serialization is a highly fragile mechanism where every object Serialization and deserialization - maybe manually, maybe by static analysis or Probably variant analysis specifically looking for inconsistent parcel Thoughts on how this vuln might have been found (fuzzing, code auditing, variant analysis, etc.): The patch spot-fixes the bug instance in WorkSource so that the treatment ofĮmpty lists becomes the same for serialization and deserialization. The commit message of the patch linked above describes the issue pretty well. Haven't looked at it but I guess it's probably public somewhere The Vulnerabilityīug class: injection via inconsistent parcel serialization/deserializationįor background on the bug class, see this bug writeup linked in the by davinci1012/davincifans101 (in english, chinese version also available)ĭid you have access to the exploit sample when doing the analysis?.Android credits Sergey Toshin of Oversecured Inc.

First Patched Version: Security Patch Level

Android projects with source code in android studio github