SVE-2021-23076漏洞分析 – 小路的博客

标题：SVE-2021-23076 (CVE-2021-25510, CVE-2021-25511): Camera privilege escalation and arbitrary file write in FilterProvider (system_app) in Samsung Device
描述：An improper validation vulnerability in FilterProvider prior to SMR Dec-2021 Release 1 allows local privilege escalation. The patch adds proper validation logic to prevent privilege escalation.
二进制的位置在/system/app/FilterProvider/FilterProvider.apk
所有组件中唯一能直接进来的就是这个PackageIntentReceiver

<receiver android:exported="true" android:name="com.samsung.android.provider.filterprovider.PackageIntentReceiver">
  <intent-filter>
    <action android:name="com.samsung.android.provider.filterprovider.INTENT_PACKAGE_ADDED"/>
    <action android:name="com.samsung.android.provider.filterprovider.INTENT_PACKAGE_REMOVED"/>
  </intent-filter>
  <intent-filter>
    <action android:name="com.samsung.filterinstaller.INSTALL_FILTER"/>
    <data android:scheme="package" android:sspPrefix="com.candycamera.android.filter"/>
    <data android:scheme="package" android:sspPrefix="com.ucam.filters.forsamsung"/>
    <data android:scheme="package" android:sspPrefix="com.pinguo.camera360filter"/>
    <data android:scheme="package" android:sspPrefix="com.linecorp.aillis.filter"/>
    <data android:scheme="package" android:sspPrefix="com.linecorp.b612.filter"/>
    <data android:scheme="package" android:sspPrefix="com.seerslab.filter"/>
    <data android:scheme="package" android:sspPrefix="com.samsung.android.filter.effect"/>
  </intent-filter>
</receiver>

而FilterProvider我们只能申请读权限

<provider android:authorities="com.samsung.android.provider.filterprovider" android:exported="true" android:name="com.samsung.android.provider.filterprovider.FilterProvider" android:readPermission="com.samsung.android.provider.filterprovider.permission.READ_FILTER" android:writePermission="com.samsung.android.provider.filterprovider.permission.WRITE_FILTER"/>

权限定义

<permission android:description="@string/permission_read_filter_desc" android:label="@string/permission_read_filter" android:name="com.samsung.android.provider.filterprovider.permission.READ_FILTER" android:protectionLevel="normal"/>
<permission android:description="@string/permission_write_filter_desc" android:label="@string/permission_write_filter" android:name="com.samsung.android.provider.filterprovider.permission.WRITE_FILTER" android:protectionLevel="signature"/>

onReceiver之后，先进行一番权限的检查，权限检查通过就启动FilterPackageService服务

@Override  // android.content.BroadcastReceiver
    public void onReceive(Context arg16, Intent arg17) {
        String v13;
        if(arg17.getDataString() == null) {
            Log.i(PackageIntentReceiver.TAG, "DataString is null : " + arg17.getAction());
            return;
        }

        String v3 = arg17.getAction();
        String v0 = arg17.getDataString().substring(8);
        if("com.samsung.filterinstaller.INSTALL_FILTER_LIST".equals(v3)) {
            //...
        }

        Log.i(PackageIntentReceiver.TAG, "action : " + v3);
        Log.i(PackageIntentReceiver.TAG, "pkgName : " + v0);
        if(("com.samsung.android.provider.filterprovider.INTENT_PACKAGE_ADDED".equals(v3)) || ("com.samsung.filterinstaller.INSTALL_FILTER".equals(v3))) {
            try {
                PackageManager v11_1 = arg16.getPackageManager();
                if(v11_1 == null) {
                    return;
                }

                PackageInfo v0_5 = v11_1.getPackageInfo(v0, 0x1000);  // package name validation bypass
                if(v0_5 == null || v0_5.requestedPermissions == null) {
                    Log.e(PackageIntentReceiver.TAG, "This package does not have permission");
                    return;
                }

                if(!Arrays.asList(v0_5.requestedPermissions).contains("com.sec.android.camera.permission.USE_EFFECT_FILTER")) {  // request permissions validation bypass
                    Log.e(PackageIntentReceiver.TAG, "This package is not a effect filter");
                    return;
                    Log.e(PackageIntentReceiver.TAG, "This package does not have permission");
                    return;
                }
            }
            catch(PackageManager.NameNotFoundException v0_4) {
                Log.e(PackageIntentReceiver.TAG, "onReceive NameNotFoundException : " + v0_4.toString());
            }
        }

        try {
            Intent v0_7 = new Intent(arg16, FilterPackageService.class);
            if(("com.samsung.android.provider.filterprovider.INTENT_PACKAGE_ADDED".equals(v3)) || ("com.samsung.android.provider.filterprovider.INTENT_PACKAGE_REMOVED".equals(v3)) || ("com.samsung.filterinstaller.INSTALL_FILTER".equals(v3)) || ("com.samsung.filterinstaller.INSTALL_FILTER_LIST".equals(v3))) {
                v0_7.fillIn(arg17, 2);
                arg16.startService(v0_7);
                return;
            }
        }
        catch(Exception v0_6) {
            Log.e(PackageIntentReceiver.TAG, "onReceive exception : " + v0_6.toString());
            return;
        }
    }

这个校验写的是让我开幕雷击，这里面至少能想到两个绕过的思路
- 首先是包名字段直接受控于dataString这个外部传入的数据，可以直接伪造sspPrefix里面指定的几个包名就可以了
- 其次requestedPermissions只代表AndroidManifest.xml中定义的权限，和实际应用是否被授予了这个权限无关
所以这里面的绕过思路就是，首先配置成白名单的URI和包名，然后再在AndroidManifest.xml定义一下权限com.sec.android.camera.permission.USE_EFFECT_FILTER即可。
测试代码以及输出

try {
    PackageManager pm = getPackageManager();
    PackageInfo pi = pm.getPackageInfo(getPackageName(), PackageManager.GET_PERMISSIONS);
    Log.d(TAG, "pi.requestedPermissions.length = " + pi.requestedPermissions.length);
    for (String requestPermission : pi.requestedPermissions) {
        Log.d(TAG, "requestedPermission: " + requestPermission);
    }
} catch (PackageManager.NameNotFoundException e) {
    e.printStackTrace();
}

D/STest: pi.requestedPermissions.length = 1
D/STest: requestedPermission: com.sec.android.camera.permission.USE_EFFECT_FILTER

扩展思考：其实这个地方想做权限控制非常简单，直接用checkCallingPermission就完了，不知道三星这是在搞什么。
启动FilterPackageService服务之后，是发了一个Handler消息

@Override  // android.app.Service
public int onStartCommand(Intent arg5, int arg6, int arg7) {
    if(arg5 == null) {
        Log.i(FilterPackageService.TAG, "onStartCommand(null)");
        return 2;
    }
    String v0 = arg5.getAction();
    this.mStartId = arg7;
    Message v7 = this.mServiceHandler.obtainMessage();
    Log.v(FilterPackageService.TAG, "onStartCommand(" + v0 + ")");
    if("com.samsung.android.provider.filterprovider.INTENT_PACKAGE_ADDED".equals(v0)) {
        v7.arg1 = 1;
        v7.obj = arg5.getData().toString();
        this.mServiceHandler.sendMessage(v7);
        return 1;
    }
    if("com.samsung.android.provider.filterprovider.INTENT_PACKAGE_REMOVED".equals(v0)) {
        v7.arg1 = 2;
        v7.obj = arg5.getData().toString();
        this.mServiceHandler.sendMessage(v7);
        return 1;
    }
    if("com.samsung.filterinstaller.INSTALL_FILTER".equals(v0)) {
        v7.arg1 = 1;
        v7.setData(arg5.getExtras());
        v7.obj = arg5.getData().toString();
        this.mServiceHandler.sendMessage(v7);
        return 1;
    }
    if("com.samsung.filterinstaller.INSTALL_FILTER_LIST".equals(v0)) {
        v7.arg1 = 3;
        v7.obj = arg5.getParcelableArrayListExtra("filter_package_list");
        this.mServiceHandler.sendMessage(v7);
        return 1;
    }
    this.stopSelfResult(this.mStartId);
    return 1;
}

Handler处理消息的代码

@Override  // android.os.Handler
public void handleMessage(Message arg8) {
    String v0_1;
    if(FilterPackageService.VERBOSE_LOGGING) {
        Log.v(FilterPackageService.TAG, "handleMessage " + arg8.arg1);
    }
    PackageManager v0 = FilterPackageService.this.getPackageManager();
    if(v0 == null) {
        Log.e(FilterPackageService.TAG, "There is no packageManager returned");
        return;
    }
    if(v0.getApplicationEnabledSetting("com.samsung.android.provider.filterprovider") == 2) {
        Log.e(FilterPackageService.TAG, "FilterProvider application is not enabled");
        return;
    }
    if(arg8.arg1 == 3) {
        v0_1 = null;
    }
    else {
        //...
    }
    int v4 = arg8.arg1;
    if(v4 == 1) {
        new FilterInstaller(FilterPackageService.this.getApplicationContext(), v0_1).installFilters();
    }
    else if(v4 == 2) {
        new FilterInstaller(FilterPackageService.this, v0_1).uninstallFilters();
    }
    else if(v4 == 3) {
        Log.d(FilterPackageService.TAG, "ACTION_LIST_ADDED");
        if(arg8.obj != null) {
            ArrayList v8 = (ArrayList)arg8.obj;
            int v0_2;
            for(v0_2 = 0; v0_2 < v8.size(); ++v0_2) {
                Log.d(FilterPackageService.TAG, ((String)v8.get(v0_2)));
                new FilterInstaller(FilterPackageService.this.getApplicationContext(), ((String)v8.get(v0_2))).installFilters(true);
            }
        }
        FilterNotifyUtil.NotifyChange(FilterPackageService.this.getApplicationContext(), 2, null);
    }
    int v0_3 = FilterPackageService.this.mStartId;
    FilterPackageService.this.stopSelfResult(v0_3);
}

可以看到1号消息是安装一个Filters，2号消息是卸载Filters，而3号消息是安装一个Filters列表，这里我们就关注1号消息

void installFilters(boolean arg4) {
    Log.i(FilterInstaller.TAG, "installFilters");
    this.createDownloadFilterDirectory();
    try {
        Bundle v0 = this.mServiceContext.getPackageManager().getApplicationInfo(this.mPackageName, 0x80).metaData;
        if(v0 != null && v0.getInt("version") == 3) {
            this.installSelFilter(this.mServiceContext, v0, this.mPackageName, ((boolean)(((int)arg4))));
            return;
        }
        this.installLibFilter(this.mServiceContext, this.mPackageName, ((boolean)(((int)arg4))));
    }
    catch(Exception v4) {
        Log.e(FilterInstaller.TAG, "installFilters error : " + v4.toString());
    }
}

这里面的this.mPackageName也是我们可以控制的，因为在FilterInstaller的构造函数里面发现他就是根据构造时传入的第二参数进行设置的，而第二参数是来源于消息对象

FilterInstaller(Context arg1, String arg2) {
    this.mPackageName = arg2;
    this.mServiceContext = arg1;
}

此外还取了目标包名应用Manifest文件里面的metaData字段，这些我们也是可以控制的
在installSelFilter中存在写入文件的操作，而文件的来源居然是我们应用的assets

private void installSelFilter(Context arg20, Bundle arg21, String arg22, boolean arg23) {
    Resources v0_5;
    Cursor v10;
    Log.i(FilterInstaller.TAG, "installSelFilter");
    String v3 = arg21.getString("title");
    String v5 = arg21.getString("vendor");
    int v7 = arg21.getInt("version");
    int v9 = arg21.getInt("title_id");
    ContentResolver v15 = arg20.getContentResolver();
    int v16 = 0;
    try {
        v10 = v15.query(Constants.URI_FILTERS, null, "package_name", new String[]{arg22}, null);
    }
    catch(Exception v0) {
        goto label_63;
    }
    //...
label_74:
    String v10_1 = null;
    try {
        v0_5 = arg20.getPackageManager().getResourcesForApplication(arg22); // Read our application resources
    }
    catch(PackageManager.NameNotFoundException v0_4) {
        Log.e(FilterInstaller.TAG, "installSelFilter, getResourcesForApplication : " + v0_4.toString());
        v0_5 = null;
    }
    AssetManager v0_6 = v0_5.getAssets(); // Read our application assets
    String v11 = v3 + ".sel";
    String v12 = this.renameFilterName(v11, arg22);
    String v13 = FilterInstaller.FILTER_STORAGE_SEL + "/" + v12;
    Bitmap v0_7 = this.decryptSelFilter(v0_6, "sel/" + v11);
    if(v0_7 != null) {
        v10_1 = this.saveBitmapFile(v0_7, v13, true);
        Log.i(FilterInstaller.TAG, "copied file path : " + v10_1);
    }
    if(v10_1 != null) {
        ContentValues v0_8 = new ContentValues();
        v0_8.put("package_name", arg22);
        v0_8.put("name", v3);
        v0_8.put("filename", v12);
        v0_8.put("vendor", v5);
        v0_8.put("version", String.valueOf(v7));
        v0_8.put("title_id", Integer.valueOf(v9));
        v0_8.put("filter_type", "SINGLE");
        v0_8.put("category", Integer.valueOf(2));
        v0_8.put("preload_filter", Integer.valueOf(0));
        v0_8.put("vendor_package_name", arg22);
        Log.i(FilterInstaller.TAG, "installSelFilter - insert DB");
        v15.insert(Constants.URI_FILTERS, v0_8);
        if(arg23) {
            v16 = 3;
        }
        FilterNotifyUtil.NotifyChange(arg20, v16, v0_8);
    }
}

改名函数是把文件名改为[package_name].[title].sel，由于title可使用任意字符所以存在路径穿越问题
解密过程的密钥和IV值全部为硬编码，可以直接拿来进行加密

private Bitmap decodeAES(String arg6) {
    try {
        byte[] v6_1 = Base64.decode(arg6, 0);
        IvParameterSpec v1 = new IvParameterSpec(FilterInstaller.IV_BYTES);
        SecretKeySpec v2 = new SecretKeySpec(FilterInstaller.SECRET_KEY.getBytes("UTF-8"), "AES");
        Cipher v3 = Cipher.getInstance("AES/CBC/PKCS5Padding");
        v3.init(2, v2, v1);
        return BitmapFactory.decodeByteArray(v3.doFinal(v6_1), 0, v3.doFinal(v6_1).length);
    }
    catch(Exception v6) {
        Log.e(FilterInstaller.TAG, "decodeAES error : " + v6.toString());
        return null;
    }
}
private Bitmap decryptSelFilter(AssetManager arg4, String arg5) {
    Log.i(FilterInstaller.TAG, "decryptSelFilter source : " + arg5);
    try {
        Scanner v4_1 = new Scanner(arg4.open(arg5)).useDelimiter("\\A");
        String v4_2 = v4_1.hasNext() ? v4_1.next() : "";
        return this.decodeAES(v4_2);
    }
    catch(Exception v4) {
        Log.e(FilterInstaller.TAG, "decryptSelFilter error : " + v4.toString());
        return null;
    }
}

密钥和IV的值

FilterInstaller.IV_BYTES = new byte[]{0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
FilterInstaller.SECRET_KEY = "[3%250947@#73985$903*&)7";

这样一来我们可以构造一个合法的Sel文件并且写入到下面的目录中

FilterInstaller.FILTER_STORAGE_ROOT_DIR = Environment.getDataDirectory().getPath();
FilterInstaller.FILTER_STORAGE_SEL = FilterInstaller.FILTER_STORAGE_ROOT_DIR + "/DownFilters";

而在installLibFilter函数中，也存在类似的逻辑

private void installLibFilter(Context arg11, String arg12, boolean arg13) {
    Cursor v1_2;
    Resources v0;
    Log.i(FilterInstaller.TAG, "install filter for Lib");
    try {
        v0 = arg11.getPackageManager().getResourcesForApplication(arg12);
    }
    catch(PackageManager.NameNotFoundException v11) {
        Log.e(FilterInstaller.TAG, "installLibFilter, resource error, package name : " + arg12 + ", exception : " + v11.toString());
        return;
    }
    ContentResolver v1 = arg11.getContentResolver();
    int v11_1 = 0;
    try {
        v1_2 = v1.query(Constants.URI_FILTERS, null, "package_name", new String[]{arg12}, null);
    }
    catch(Exception v1_1) {
        goto label_67;
    }
    //...
label_70:
    AssetManager v1_4 = v0.getAssets();
    String[] v2_1 = new String[0];
    try {
        v2_1 = v1_4.list("so");
    }
    catch(IOException v3_1) {
        Log.e(FilterInstaller.TAG, "installLibFilter, asset lib list exception : " + v3_1.toString());
    }
    if(v2_1.length <= 0) {
        Log.e(FilterInstaller.TAG, "asset lib list length is small than 0");
        return;
    }
    int v3_2 = v2_1.length;
    int v4;
    for(v4 = 0; v4 < v3_2; ++v4) {
        String v5 = v2_1[v4];
        Log.i(FilterInstaller.TAG, "filterFile : " + v5);
        if(this.storeLibFilters(v1_4, v0, v5, v5.split("\\.")[0]) == -1L && (v5.endsWith(".so"))) {
            Log.e(FilterInstaller.TAG, "storeLibFilters fail");
        }
    }
    ContentValues v0_1 = new ContentValues();
    v0_1.put("package_name", arg12);
    Context v12 = this.mServiceContext;
    if(arg13) {
        v11_1 = 3;
    }
    FilterNotifyUtil.NotifyChange(v12, v11_1, v0_1);
}

也是从我们应用的assets中取文件，storeLibFilters的逻辑如下

private long storeLibFilters(AssetManager arg17, Resources arg18, String arg19, String arg20) {
    String v8;
    String v15 = null;
    String v13 = null;
    Log.i(FilterInstaller.TAG, "storeLibFilters - title : " + arg20 + ", file name : " + arg19);
    String v6 = this.renameFilterName(arg19, this.mPackageName);
    Log.i(FilterInstaller.TAG, "newFileName : " + v6);
    String v7 = this.copyFileFromAssets(arg17, "so/" + arg19, FilterInstaller.FILTER_STORAGE_LIB + "/" + v6, true);
    if(v7 == null) {
        Log.e(FilterInstaller.TAG, "lib copy failed : " + v6);
        return -1L;
    }
    try {
        if(arg17.list("so_arm64").length > 0) {
            v8 = this.copyFileFromAssets(arg17, "so_arm64/" + arg19, FilterInstaller.FILTER_STORAGE_LIB64 + "/" + v6, true);
            if(v8 == null) {
                Log.e(FilterInstaller.TAG, "lib64 copy failed : " + v6);
                return -1L;
            }
        }
        else {
            goto label_98;
        }
        goto label_99;
    }
    catch(IOException v0) {
        Log.e(FilterInstaller.TAG, "Exception from check 64bit library so file : " + v0.toString());
        return -1L;
    }
label_98:
    v8 = null;
    try {
    label_99:
        String[] v15_1 = arg17.list("tex");
        if(v15_1.length > 0) {
            v15 = this.renameFilterName(v15_1[0], this.mPackageName);
            v13 = this.copyFileFromAssets(arg17, "tex/" + v15_1[0], FilterInstaller.FILTER_STORAGE_TEXTURE + "/" + v15, true);
            if(v13 == null) {
                Log.e(FilterInstaller.TAG, "texture copy failed : " + v15);
                return -1L;
            }
        }
        else {
            goto label_148;
        }
    }
    catch(IOException v0_1) {
        Log.e(FilterInstaller.TAG, "installLibFilter, asset texture list exception : " + v0_1.toString());
    }
    goto label_154;
label_148:
    v13 = null;
    v15 = null;
label_154:
    Log.i(FilterInstaller.TAG, "success copy lib32 : " + v7);
    Log.i(FilterInstaller.TAG, "success copy lib64 : " + v8);
    Log.i(FilterInstaller.TAG, "success copy texture : " + v13);
    if((arg19.endsWith(".so")) && !this.checkSoSignature(v6)) {
        Log.e(FilterInstaller.TAG, "Signature check failed.");
        return -1L;
    }
    if(!arg19.endsWith(".sig")) {
        ContentResolver v8_1 = this.mServiceContext.getContentResolver();
        ContentValues v9 = new ContentValues();
        try {
            int v0_3 = arg18.getIdentifier(arg20 + "_title", "string", this.mPackageName);
            int v7_1 = arg18.getIdentifier(arg20 + "_vendor", "string", this.mPackageName);
            int v4 = arg18.getIdentifier(arg20 + "_version", "string", this.mPackageName);
            Log.e(FilterInstaller.TAG, "title = " + arg18.getString(v0_3) + ", vendor = " + arg18.getString(v7_1) + ", version = " + arg18.getString(v4));
            v9.put("name", arg18.getString(v0_3));
            v9.put("filename", v6);
            v9.put("version", arg18.getString(v4));
            v9.put("vendor", arg18.getString(v7_1));
            v9.put("package_name", this.mPackageName);
            v9.put("title_id", Integer.valueOf(v0_3));
            v9.put("preload_filter", Integer.valueOf(0));
            v9.put("filter_type", "SINGLE");
            v9.put("category", Integer.valueOf(2));
            v9.put("vendor_package_name", this.mPackageName);
            if(v13 != null) {
                v9.put("texture", v15);
            }
        }
        catch(Resources.NotFoundException v0_2) {
            Log.e(FilterInstaller.TAG, "Resource is not defined properly! " + v0_2.toString());
            return -1L;
        }
        Uri v0_4 = v8_1.insert(Constants.URI_FILTERS, v9);
        if(v0_4 == null) {
            if(FilterPackageService.VERBOSE_LOGGING) {
                Log.v(FilterInstaller.TAG, "Installation failure: " + arg19);
            }
            return -1L;
        }
        return (long)Long.valueOf(v0_4.getLastPathSegment());
    }
    return -1L;
}

里面大概的逻辑就是，取so文件夹下的32位ELF和so_arm64下的64位ELF，以及tex下的texture文件，并且对于so结尾的文件存在签名校验
这个签名校验是使用的一个硬编码的公钥进行校验的，如果无法获得私钥是没办法绕过的。不过由于这个东西看起来像一个业务特性，可以尝试逆向那些本来就在白名单里的应用看能否找到私钥，也就是下面这些URI所对应的应用

com.candycamera.android.filter
com.ucam.filters.forsamsung
com.pinguo.camera360filter
com.linecorp.aillis.filter
com.linecorp.b612.filter
com.seerslab.filter
com.samsung.android.filter.effect

然而即使是无法转化为代码执行，这里也同样存在路径穿越可以写入任意文件。而且从漏洞描述来看，很可能上报者是成功找到了这个私钥的。