1

I heard about maybe a week ago and it sounds to me like extremly critical vulnerability. But i didn't find any technical description of it. Just that you can remotely execute code just by sending your victim specially crafted image with changed exif.

Can someone give me better technical description of whats really going on ? I also know its bug in the C library so google already rewrote it in Java. Thanks for every advice. Also, is there public exploit available ?

2

I can't find any indication of this being active in the wild.

What is happening is that the code that examines and makes sense of image metadata, specifically the EXIF data is faulty. By carefully including invalid data (the details are not, of course, available), it is very likely causing a buffer overflow so that some of the data ends up in a memory space that belongs to active code and therefore gets executed. Clearly that memory space normally belongs to some privileged code. This type of issue accounts I think (last time I heard) for around 90% of all security issues in C/C++ code.

The problem with Android is that system updates are left to the carriers who choose when/if to send out updates from the phone suppliers who choose when/if to even apply fixes. It is a total shambles. It leaves many Android users with vulnerable phones. So while Google may have issued a fix, there is absolutely no guarantee that it will make its way through to handsets in use.

1

After some digging, I believe I have located the vulnerable line of code.

From the Android Security Bulletin—September 2016 we find this information:

Remote code execution vulnerability in Mediaserver

A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process.

  • CVE: CVE-2016-3862
  • References: A-29270469
  • Severity: Critical Updated
  • Nexus devices: All Nexus
  • Updated AOS versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1
  • Date reported: Jun 10, 2016

Which leads to this commit diff which shows where they removed the jhead dependency from ExifInterface.java. So based on the date reported, roughly 3 months before hand the issue in jhead was probably addressed.

That correlates with the following commit diff in jhead:

@@ -614,7 +614,7 @@
             unsigned OffsetVal;
             OffsetVal = Get32u(DirEntry+8);
             // If its bigger than 4 bytes, the dir entry contains an offset.
-            if (OffsetVal+ByteCount > ExifLength){
+            if (OffsetVal > UINT32_MAX - ByteCount || OffsetVal+ByteCount > ExifLength){
                 // Bogus pointer offset and / or bytecount value
                 ErrNonfatal("Illegal value pointer for tag %04x", Tag,0);
                 continue;

Which has the following commit message:

Fix possible out of bounds access

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.