Buffer Overflow Exploit Discovered In Android SDK

Android SDK also suffers lack of compile-time hardening.

The droidsec security group has discovered and patched a buffer overflow issue and a lack of compile-time hardening in the Android Debug Bridge, with the team deciding to publicly disclose the issues and patches after a lack of communication from Google. The buffer overflow exploit discovered in the Android software development kit effects all versions of the Android Debug Bridge on Linux x86_64.

According to droidsec the exploit has been confirmed on version 18.0.1 of the Android SDK platform tools on x86_64 Ubuntu Linux 12.04. Meanwhile, attempts of exploitation on a 32-bit Linux system and the adb binary found on the Nexus 4 were unsuccesful. Windows systems were kept out of the test.

The exploit starts with an attacker starting a malicious Android Debug Bridge (ADB) server. This ADB server then interfaces with Android devices on a multi-user system and waits for ADB clients to connect. Any command that communicates with the ADB Server will lead to 'successful' exploitation. Further, it has been found that the ADB binary failed to have a non-executable stack. Also the executable was not position independent.

"It should also be noted that host compilation also seems to intentionally opt out of the FORTIFY_SOURCE protections. It's not clear why this is the case since the comment near this line of code references an internal only bug number." " droidsec was quoted as saying.

Shivam Kotwalia, CodeKill