关键信息 漏洞标题: Samsung - 'seiren' Kernel Driver Buffer Overflow EDB-ID: 38556 CVE: 2015-7890 作者: Google Security Research 类型: DOS (Denial of Service) 平台: Android 日期: 2015-10-28 漏洞应用: Exynos Seiren Audio driver 漏洞描述 The Exynos Seiren Audio driver contains a device endpoint (/dev/seiren) accessible by the system user or audio group (such as the mediaserver). The write() implementation for this driver has a buffer overflow vulnerability that can overflow a static global buffer. 问题: The user-supplied buffer and size parameters are not adequately bounds checked. The destination buffer is fixed size, leading to potential memory corruption. 利用方式: A simple proof-of-concept from a privileged shell can trigger the issue, tested on a Samsung S6 Edge: 参考链接 Source: https://code.google.com/p/google-security-research/issues/detail?id=491 Advisory/Source: Link