0x00 漏洞说明

1. Zygote

2. 漏洞信息

0x01 漏洞利用

1. 攻击场景

1. 要存储在 hidden_api_blacklist_exemptions 中的 Base64 编码值；

2. 由硬编码的 Google 控制密钥对该值进行的 ECDSA 签名。

2. Android11-

以及为什么最后一个entry不是空的：Note that the last delay entry isn’t empty like the rest. That’s to work around the fact that Java’s String.split() function, used by System Server to parse the setting value, discards trailing empty strings.

3. Android12+

1. 如果客户端连续写入两个命令，而Zygote还没来得及读取，Zygote会忽略第二个命令。

2. 如果客户端写入一个半命令（例如，因为第二个命令需要多次write调用），Zygote会忽略第二个命令的开始部分，并将其结尾部分解析为新的命令，这本身就是一个安全漏洞。然而，系统服务器（Zygote的唯一客户端）从不一次写入多个命令，因此这种情况（以及前一种情况）在实践中不会发生。

• BufferedWriter：maybeSetApiDenylistExemptions() 方法多次调用 state.mZygoteOutputWriter.write()。mZygoteOutputWriter 是一个 BufferedWriter，它在写入到底层传输之前会在内部缓冲区中聚合写入操作。

• 缓冲区大小：BufferedWriter 的缓冲区大小为 8192 字节，比 Zygote 的缓冲区小。这提供了一种方法，可以在两次套接字写入之间产生适当的延迟。

1. 通过将 System Server 的命令填充到正好 8192 字节，然后插入恶意命令，强制 BufferedWriter 先写入这 8192 字节。Zygote 会忽略填充部分，但不会忽略新到达的恶意命令，因为它会在一个单独的 read() 调用中到达。

2. 增加延迟：在设置值的末尾插入大量逗号，使 maybeSetApiDenylistExemptions() 在第一次写入后但在第二次写入前花费时间循环。这些逗号还增加了合法命令的参数数量，但只要确保前 8192 字节包含足够多的换行符号。

A successful exploit degrades or prevents subsequent process launches until a reboot. That’s because the injected Zygote command outputs extra result bytes that System Server doesn’t consume. System Server uses a single connection to Zygote for all non-USAP commands, so those bytes stick around until it tries to spawn another process, at which point it reads them instead of that process’s PID. System Server won’t bind a process without record of its PID, and processes that fail to bind get killed.

We avoided this issue on Android 12+ by slightly modifying our exploit: we declared an argument count for our injected command that exceeded the number of newlines in our final socket write, which forced Zygote to perform an additional socket read while parsing it. That read ate whatever command happened to follow ours (overwhelmingly likely to be a process spawn) and prevented Zygote from executing it. Our malicious command in effect replaced that legitimate command, and System Server consumed its PID (actually our PID) as normal, allowing subsequent PIDs to remain in sync.

This modification also made persistence feasible, as the setting can retain its malicious value across reboots without disrupting the boot process.

0x02 漏洞修复

Refuse to deal with newlines and null characters in HiddenApiSettings.update(). Also disallow nulls in process start arguments.

Today’s patch does not address the architectural weaknesses we identified, like Zygote’s use of a hand-rolled stream protocol or ZygoteProcess’s lack of a reusable function to safely serialize commands, as those entail bigger changes and are not directly exploitable. Google has has communicated that they’re considering such changes going forwards, though.

参考

1. https://rtx.meta.security/exploitation/2024/06/03/Android-Zygote-injection.html

2. https://mp.weixin.qq.com/s/PoGRFwUD736nkLocRGvP_g