CVE-2020-0041 PoC — Google Android Binder 缓冲区错误漏洞

Source

https://github.com/j4nn/CVE-2020-0041

Associated Vulnerability

Title:Google Android Binder 缓冲区错误漏洞 (CVE-2020-0041)
Description:In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel

Readme

# CVE-2020-0041

This repository contains LPE code for exploiting CVE-2020-0041 implemented by bluefrostsecurity as released at https://github.com/bluefrostsecurity/CVE-2020-0041/tree/master/lpe .
The exploitation approach for this part can be found at https://labs.bluefrostsecurity.de/blog/2020/04/08/cve-2020-0041-part-2-escalating-to-root/ .

This forked repository shall host ports for other kernels / devices in their specific branches.
Big thanks to bluefrostsecurity for their awesome writeup and the exploit release.

File Snapshot


 [4.0K]  /data/pocs/6b02f4fd4326528d9638e7de37ce98f5669c9c3b
├── [ 314]  Android.mk
├── [  78]  Application.mk
├── [ 18K]  COPYING
├── [4.0K]  include
│   ├── [4.0K]  binder.h
│   ├── [ 390]  binder_lookup.h
│   ├── [ 646]  endpoint.h
│   ├── [ 206]  exploit.h
│   ├── [ 257]  handle.h
│   ├── [  88]  helpers.h
│   ├── [ 225]  log.h
│   ├── [1.3K]  node.h
│   ├── [ 769]  pending_node.h
│   ├── [ 303]  realloc.h
│   └── [ 15K]  uapi_binder.h
├── [ 613]  Makefile
├── [3.4K]  README-lpe.md
├── [ 526]  README.md
└── [4.0K]  src
    ├── [ 31K]  binder.c
    ├── [ 12K]  binder_lookup.c
    ├── [7.4K]  endpoint.c
    ├── [ 28K]  exploit.c
    ├── [ 462]  helpers.c
    ├── [ 608]  log.c
    ├── [ 13K]  node.c
    ├── [9.9K]  pending_node.c
    └── [5.9K]  realloc.c

2 directories, 26 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!