Exploitation Of A Modern Smartphone Baseband 5
will call xsms_isPRL (pseudocode which we simplified to make the bug more
clear).
1
byte pos = 0;
/∗ i n i t i a l copy of raw content . . . omitted ∗/
3
f o r ( index = 1; index < 20; index++ {
5
memcpy s ( parsedDst + byte pos , someControlledLen , smsInput
+ someControlledOffset , someControlledLen ) ;
byte pos += someControlledLen ;
7
}
This function is responsible to rearrange this PRL SMS.
It takes as argument the sms received input.
The problem is that the message is parsed and offsets are extracted. Then
the message is reassembled, but byte_pos is not checked if it’s out of bound.
So we can craft submessages to write past the end of the parsedDst buffer
which is of fixed size and on the stack.
In IDA Pro disassebled binary it’s clear that they moved to memcpy s but
the source and destination sizes are the same and they didn’t add checks.
memcpy s style memory copy function are common in several basebands. It’s
a custom version of memcpy which takes 4 arguments: destination, destination
size, source, source size. This is to try to detect buffer overflows, since it can
check also the destination buffer size if called properly.
We found that this construct is often effective, stopping some bugs.
We can take a look at the decompiled version of that function:
i f ( ! V MemCpy s (( uint32 t )&pstTLMsg [ 1 ] , v16 + 2 , ( unsigned
int )&ucBDRaw[ v17 ] , v16 + 2 , 0x4123u , 0x46Cu) )
2
PANIC(1744830464 , 0 , 1092813932 , 0 , 0) ;
v11 = ( unsigned i n t 8 ) ( v16 + 2) ;
4
i f ( ! V MemCpy s (( uint32 t )&pstTLMsg [ 1 ] + v11 , v18 + 2 , (
unsigned
int )&ucBDRaw[ v19 ] , v18 + 2 , 0x4123u , 0x474u ) ) PANIC(0
x68000000 , 0 , 0x41230474 , 0 , 0) ;
6
r e s u l t = &bdParamShort ;
v12 = ( unsigned i n t 8 ) ( v11 + v18 + 2) ;
8
f o r ( i = 2; ; i = ( unsigned i n t 8 ) ( i + 1) ) {
v14 = ( unsigned i n t 8 ) ( i − 1) ; i f ( v14 != 15 )
10
{
i f ( 1 << v14 == ( usPresentFlag & (1 << v14 ) ) ) {
12
i f ( ! V MemCpy s( ( uint32 t )&pstTLMsg [ 1 ] + v12 ,
3 ∗ v14 + 2) ] ,
14
( unsigned ( unsigned
( unsigned 0x4123u , 0x488u ) )
16
i n t 8 )∗(&bdParamShort + 3 ∗ v14 + 1) + 2 , int )&ucBDRaw [ (
unsigned i n t 8 )∗(&bdParamShort +
i n t 8 )∗(&bdParamShort + 3 ∗ v14 + 1) + 2 ,