flawopen.com/Teardowns/cve-2020-0022-android-bluetooth-hci-heap-overflow

● CVE-2020-0022 · CVSS 8.8 · Tinggi
Riset Keamanan · FlawOpen

CVE-2020-0022: Android Fluoride Bluetooth HCI Heap Buffer Overflow Teardown

Analisis teknis mendalam dan mitigasi rekayasa sistem untuk vulnerabilidade: How an unchecked fragmentation boundary mismatch in system/bt/stack/l2cap enabled zero-click remote code execution over Bluetooth.

💡 Penjelasan Sederhana (ELI5)

Analogi dunia nyata: Imagine a post office that accepts letters in numbered pieces (Part 1 of 2, Part 2 of 2). An attacker sends Part 1 stating 'the whole letter is 50 words'. The clerk prepares a tiny envelope. Then the attacker sends Part 2 containing 5,000 words! The clerk shoves the words in, bursting the envelope and scattering private documents all over the floor.

Konsep Kunci & Istilah

Fluoride Bluetooth Stack
The open-source C/C++ Bluetooth protocol stack used in Android, handling L2CAP, SDP, and RFCOMM.
HCI (Host Controller Interface)
The protocol layer communicating between the software Bluetooth stack and the hardware radio chip.
L2CAP (Logical Link Control and Adaptation Protocol)
The protocol responsible for segmenting and reassembling network packets across Bluetooth links.
Heap Buffer Overflow
Writing packet payload data past the allocated boundaries of a heap chunk.

Analisis Akar Masalah (Root Cause)

Akar masalah bermula dari parameter batas yang tidak divalidasi pada sistem open source, yang memungkinkan desinkronisasi status dan bypass kontrol keamanan.

Alur Serangan Langkah demi Langkah

Step 1

Tahap serangan: Attacker in Bluetooth Range

Mekanisme eksploitasi teknis dan detail eksekusi: The attacker broadcasts crafted ACL packets toward a nearby Android device.

Step 2

Tahap serangan: Sending Incomplete First Fragment

Mekanisme eksploitasi teknis dan detail eksekusi: The attacker sends an initial L2CAP packet claiming a small total packet length.

Step 3

Tahap serangan: Sending Oversized Continuation Packet

Mekanisme eksploitasi teknis dan detail eksekusi: The attacker sends a second fragment with an unexpected payload size exceeding the allocation.

Step 4

Kerusakan Memori : Heap Corruption in com.android.bluetooth

Mekanisme eksploitasi teknis dan detail eksekusi: The reassembly loop overwrites adjacent heap chunks, executing code inside the Bluetooth daemon.

Kode Sumber: Rentan vs Aman

IMPLEMENTASI RENTAN
// VULNERABLE: system/bt/stack/l2cap/l2c_main.cc
void l2c_rcv_acl_data(BT_HDR *p_msg) {
    tL2C_LCB *p_lcb = l2cu_find_lcb_by_handle(handle);
    
    // ROOT CAUSE:
    // Does not verify that accumulated fragment lengths stay within allocated buffer!
    uint8_t *p_dest = p_lcb->p_rx_msg->data + p_lcb->p_rx_msg->offset;
    
    // Copies fragment without boundary checking!
    memcpy(p_dest, p_msg->data, p_msg->len);
    p_lcb->p_rx_msg->offset += p_msg->len;
}
PERBAIKAN AMAN & KUAT
// SECURE: system/bt/stack/l2cap/l2c_main.cc patch
void l2c_rcv_acl_data(BT_HDR *p_msg) {
    tL2C_LCB *p_lcb = l2cu_find_lcb_by_handle(handle);
    
    // 1. Calculate remaining capacity in allocated reassembly buffer
    size_t remaining_capacity = p_lcb->p_rx_msg->total_len - p_lcb->p_rx_msg->offset;
    
    // 2. Reject fragment if incoming length exceeds remaining capacity
    if (p_msg->len > remaining_capacity) {
        L2CAP_TRACE_ERROR("L2CAP packet overflow: len %d exceeds remaining %zu", 
                          p_msg->len, remaining_capacity);
        osi_free(p_lcb->p_rx_msg);
        p_lcb->p_rx_msg = nullptr;
        return; // Abort cleanly
    }
    
    uint8_t *p_dest = p_lcb->p_rx_msg->data + p_lcb->p_rx_msg->offset;
    memcpy(p_dest, p_msg->data, p_msg->len);
    p_lcb->p_rx_msg->offset += p_msg->len;
}

Daftar Periksa Penguatan Sistem Rekayasa

Sumber