flawopen.com/Teardowns/cve-2020-0022-android-bluetooth-hci-heap-overflow

● CVE-2020-0022 · CVSS 8.8 · 높음
보안 연구 · FlawOpen

심층 기술 분석: CVE-2020-0022: Android Fluoride Bluetooth HCI Heap Buffer Overflow Teardown

vulnerabilidade 소스 코드 심층 기술 분석 및 시스템 보안 강화 가이드: 취약점 근본 원인과 패치 메커니즘 분석.

💡 알기 쉬운 설명 (ELI5)

직관적인 현실 비유 설명: Imagine a post office that accepts letters in numbered pieces (Part 1 of 2, Part 2 of 2). An attacker sends Part 1 stating 'the whole letter is 50 words'. The clerk prepares a tiny envelope. Then the attacker sends Part 2 containing 5,000 words! The clerk shoves the words in, bursting the envelope and scattering private documents all over the floor.

핵심 개념 및 용어

Fluoride Bluetooth Stack
The open-source C/C++ Bluetooth protocol stack used in Android, handling L2CAP, SDP, and RFCOMM.
HCI (Host Controller Interface)
The protocol layer communicating between the software Bluetooth stack and the hardware radio chip.
L2CAP (Logical Link Control and Adaptation Protocol)
The protocol responsible for segmenting and reassembling network packets across Bluetooth links.
Heap Buffer Overflow
Writing packet payload data past the allocated boundaries of a heap chunk.

근본 원인 분석 (Root Cause)

근본 원인은 오픈 소스 시스템의 검증되지 않은 경계 매개변수로 인해 상태 비동기화 및 보안 제어 우회가 발생한 데 있습니다.

단계별 공격 실행 흐름

Step 1

공격 실행 단계: Attacker in Bluetooth Range

기술적 취약점 악용 메커니즘 및 상세 실행 경로: The attacker broadcasts crafted ACL packets toward a nearby Android device.

Step 2

공격 실행 단계: Sending Incomplete First Fragment

기술적 취약점 악용 메커니즘 및 상세 실행 경로: The attacker sends an initial L2CAP packet claiming a small total packet length.

Step 3

공격 실행 단계: Sending Oversized Continuation Packet

기술적 취약점 악용 메커니즘 및 상세 실행 경로: The attacker sends a second fragment with an unexpected payload size exceeding the allocation.

Step 4

메모리 손상（Heap Corruption in com.android.bluetooth）

기술적 취약점 악용 메커니즘 및 상세 실행 경로: The reassembly loop overwrites adjacent heap chunks, executing code inside the Bluetooth daemon.

소스 코드 비교: 취약한 구현 vs 보안 패치

취약한 구현
// VULNERABLE: system/bt/stack/l2cap/l2c_main.cc
void l2c_rcv_acl_data(BT_HDR *p_msg) {
    tL2C_LCB *p_lcb = l2cu_find_lcb_by_handle(handle);
    
    // ROOT CAUSE:
    // Does not verify that accumulated fragment lengths stay within allocated buffer!
    uint8_t *p_dest = p_lcb->p_rx_msg->data + p_lcb->p_rx_msg->offset;
    
    // Copies fragment without boundary checking!
    memcpy(p_dest, p_msg->data, p_msg->len);
    p_lcb->p_rx_msg->offset += p_msg->len;
}
보안 강화 패치
// SECURE: system/bt/stack/l2cap/l2c_main.cc patch
void l2c_rcv_acl_data(BT_HDR *p_msg) {
    tL2C_LCB *p_lcb = l2cu_find_lcb_by_handle(handle);
    
    // 1. Calculate remaining capacity in allocated reassembly buffer
    size_t remaining_capacity = p_lcb->p_rx_msg->total_len - p_lcb->p_rx_msg->offset;
    
    // 2. Reject fragment if incoming length exceeds remaining capacity
    if (p_msg->len > remaining_capacity) {
        L2CAP_TRACE_ERROR("L2CAP packet overflow: len %d exceeds remaining %zu", 
                          p_msg->len, remaining_capacity);
        osi_free(p_lcb->p_rx_msg);
        p_lcb->p_rx_msg = nullptr;
        return; // Abort cleanly
    }
    
    uint8_t *p_dest = p_lcb->p_rx_msg->data + p_lcb->p_rx_msg->offset;
    memcpy(p_dest, p_msg->data, p_msg->len);
    p_lcb->p_rx_msg->offset += p_msg->len;
}

엔지니어링 및 시스템 보안 강화 체크리스트

출처