Google Android 直到 4.4.1 Volume Management Daemon VolumeManager.cpp 标识符权限提升

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
4.2	$0-$5k	0.00

摘要信息

在Google Android 直到 4.4.1 中已发现分类为棘手的漏洞。此漏洞会影响未知代码文件VolumeManager.cpp的组件Volume Management Daemon。由于参数标识符被操作，进而引发权限提升。没有可利用漏洞。推荐对受影响的组件进行升级。

细节信息

在Google Android 直到 4.4.1 中已发现分类为棘手的漏洞。此漏洞会影响未知代码文件VolumeManager.cpp的组件Volume Management Daemon。由于参数标识符被操作，进而引发权限提升。使用CWE来声明会导致 CWE-269 的问题。通告内容摘要如下：

Vold (Volume Management Daemon) is a daemon running as root, which main goal is to handle removable media devices. ASEC are secured containers allowing applications to securely store data on the SD card, and have been introduced back in 2010. These containers have been created because the SD Card filesystem (VFAT) does not allow privileges separation.

该漏洞已于 2014-06-03 由Fabien Perigaud 与CERT-LEXSI 以Local root vulnerability in Android 4.4.2 作为Blog Post （网站）发布。公告共享下载网址是blog.cassidiancybersecurity.com。

有技术细节可用。此漏洞的受欢迎程度低于平均值。没有可利用漏洞。漏洞利用的当前现价为美元计算大致为USD $0-$5k。 MITRE ATT&CK项目使用攻击技术T1068来解决该问题。通告提到：

there is no check on the "id" variable, which is the name given by the user to its ASEC container. It is therefore possible to perform a basic path traversal, to create the ASEC file and its mount point in a different directory than expected, as for example one the "attacker" can write into. (...) This means that if the mount point already exists, no error is raised, and the container is correctly mounted in "mountPoint". Guess what? If "mountPoint" already exists AND is a symlink to an existing directory, the ASEC container will be mounted over this directory. And the user will have full access to it, allowing him to write new files inside.

如果有长度，则声明为未定义。作为零日漏洞，其地下市场的估计价格约为$100k 以及更多。

将版本升级到 4.4.2 能够修复该问题。推荐对受影响的组件进行升级。此漏洞将通过以下代码实现修复：

bool VolumeManager::isLegalAsecId(const char *id) const {
  size_t i;
  size_t len = strlen(id);
  if (len == 0) {
    return false;
  }
  if ((id[0] == '.') || (id[len - 1] == '.')) {
    return false;
  }
  for (i = 0; i < len; i++) {
    if (id[i] == '.') {
      // i=0 is guaranteed never to have a dot. See above.
      if (id[i-1] == '.') return false;
      continue;
    }
    if (id[i] == '_' || id[i] == '-') continue;
    if (id[i] >= 'a' && id[i] <= 'z') continue;
    if (id[i] >= 'A' && id[i] <= 'Z') continue;
    if (id[i] >= '0' && id[i] <= '9') continue;
    return false;
  }
  return true;
}

该公告包含如下评论：