二进制漏洞分析-4.华为安全监控漏洞(SMC SE 工厂检查 OOB 访问)

此通报包含有关以下漏洞的信息：

CVE-2022-46316 漏洞 TA_fp_tee_get_indices中的参数缓冲区溢出
HWPSIRT-2022-16269 lib_sync_sensor_info中的代码指针泄漏
HWPSIRT-2022-64748 访问全局变量时缺少锁定

参数缓冲区溢出`TA_fp_tee_get_indices`¶

命令（ID #0x11）中的缓冲区存在缓冲区溢出。TEE_ParamTA_fp_tee_get_indices

TA_fp_tee_get_indicescalls ，它需要缓冲区及其大小。但是，在本例中，大小来自存储在第一个参数中的用户控制的值。fpc_ta_get_indicesTEE_Param

uint64_t TA_fp_tee_get_indices(uint32_t paramTypes, TEE_Param params[4]) {
    // [...]
    ret = fpc_ta_get_indices(params[1].memref.buffer, &params[0].value.a);
    // [...]
}

然后，此地址和大小将从传播到。fpc_ta_get_indicesfpc_db_get_primary_and_privacy_fingerprint_indices

uint64_t fpc_ta_get_indices(void *obuf1_addr, unsigned int *ioval0_a_p) {
    // [...]
    indices = fpc_db_get_indices(
        g_user_template_db,
        fp_active_fingerprint_set_key,
        obuf1_addr,
        *ioval0_a_p,
        ioval0_a_p);
    // [...]
}

uint64_t fpc_db_get_indices(user_db_t *user_db, uint32_t key,
    uint32_t *outbuf, uint32_t oufbuf_len, uint32_t *outbuf_count_p)
{
    // [...]
    fpc_db_get_primary_and_privacy_fingerprint_indices(
        user_db, outbuf, oufbuf_len_, outbuf_count_p);
    // [...]
}

在中，由用户控制的长度用于计算缓冲区的末尾，以将其所有字节设置为 0。如果我们指定的大小超过缓冲区的实际长度，则会发生溢出。fpc_db_get_primary_and_privacy_fingerprint_indices

uint64_t fpc_db_get_primary_and_privacy_fingerprint_indices(user_db_t *user_db,
    uint32_t *outbuf, uint32_t oufbuf_len, uint32_t *outbuf_count_p)
{
    // [...]
    curr_obuf_p = outbuf;
    obuf_end = outbuf + oufbuf_len;
    do
        *curr_obuf_p++ = 0;
    while ( v8 != v9 );
    // [...]
}

可以使用概念验证代码触发此 bug，结果如下：

[HM] [ERROR][2171]vmem_as_ondemand_prepare failed
[HM] [ERROR][2496]process 1e00000028 (tid: 40) data abort: 
[HM] [ERROR][2498]Bad memory access on address: 0x70005000, fault_code: 0x92000047
[HM] 
[HM] Dump task states for tcb
[HM] ----------
[HM]     name=[TA_uDFingerPrin] tid=40 is-idle=0 is-curr=0
[HM]     state=BLOCKED@MEMFAULT sched.pol=0 prio=46 queued=1
[HM]     aff[0]=ff
[HM]     flags=0 smc-switch=0 ca=8053 prefer-ca=8053
[HM] Registers dump:
[HM] ----------
[HM] 64 bits userspace stack dump:
[HM] ----------
[HM] <fpc_db_get_primary_and_privacy_fingerprint_indices+0x40/0x164>
[HM] <fpc_db_get_indices>+0xf0/0x188
[HM] <fpc_db_get_indices>+0xf0/0x188
[HM] <fpc_ta_get_indices>+0x38/0xcc
[HM] <TA_fp_tee_get_indices>+0x98/0x140
[HM] <tee_task_entry>+0x7f0/0x868
[HM] <thread_func_wrapper>+0x34/0x58
[HM] Dump task states END
[HM]

代码指针泄漏`lib_sync_sensor_info`¶

中存在多个代码指针泄漏。该函数用于解析 TA 可以调用的库函数的地址。在解析函数后，其地址将使用打印，因此可以使用从正常世界访问。lib_sync_sensor_infoSLoglogcat

uint64_t TA_fp_tee_get_indices(uint32_t paramTypes, TEE_Param params[4]) {
    // [...]
    ret = fpc_ta_get_indices(params[1].memref.buffer, &params[0].value.a);
    // [...]
}
1

可以使用概念证明代码触发此 bug，该代码将产生以下输出：

[TA_uDFingerPrint-1] [debug] 2685:TA_fp_init_so_lib:TA_fp_init_so_lib
[TA_uDFingerPrint-1] fpc_init_so_lib: sensor_type:0x1211
[TA_uDFingerPrint-1] fpc_init_so_lib: alg_lib_name:libalgorithm1211.so
[TA_uDFingerPrint-1] fpc_init_so_lib: algorithm dlopen start
[TA_uDFingerPrint-1] fpc_init_so_lib: p_lib_name:g_palgorithm, lib_name:libalgorithm1211.so, p_lib:0x3d116c0
[TA_uDFingerPrint-1] fpc_init_so_lib: algorithm lib dlopen success
[TA_uDFingerPrint-1] fpc_init_so_lib: p_algorithm:16843968
[TA_uDFingerPrint-1] fp_algorithm_func_dlsym: IN
[TA_uDFingerPrint-1] fp_algorithm_func_dlsym: lib:g_palgorithm, func_name:fp_init_alg_and_pp_lib, func:0x3d8e258
[TA_uDFingerPrint-1] fp_algorithm_func_dlsym: lib:g_palgorithm, func_name:fp_init_check_template_version, func:0x3d8e260
[TA_uDFingerPrint-1] fp_algorithm_func_dlsym: lib:g_palgorithm, func_name:fp_get_current_template_version, func:0x3d8e2e0

访问全局变量时缺少锁定¶

正如加载 trustlet 时在日志中显示的那样，它是多会话。因此，在访问或修改全局变量时必须格外小心。不幸的是，这个 trustlet 没有做任何形式的锁定，所以出现了许多竞争条件问题。

[GTask] TA name: TA_uDFingerPrint, UUID: a423e43d, ELF: 1461440, stack: 191072, heap: 29884416, multi session: True, keepalive: False, singleInstance: True

通过编写同时调用多个命令的多线程 CA，应该可以触发双重释放、释放后使用和各种崩溃。可以在数据库、指纹集和模板对象（这些对象都是堆分配并存储在全局变量中）上触发争用条件。

使用并发触发争用条件的概念验证代码会导致以下崩溃：TA_fp_tee_init

[HM] [ERROR][2171]vmem_as_ondemand_prepare failed
[HM] [ERROR][2496]process 220000003c (tid: 60) data abort: 
[HM] [ERROR][2498]Bad memory access on address: 0x0, fault_code: 0x92000046
[HM] 
[HM] Dump task states for tcb
[HM] ----------
[HM]     name=[TA_uDFingerPrin] tid=60 is-idle=0 is-curr=0
[HM]     state=BLOCKED@MEMFAULT sched.pol=0 prio=46 queued=1
[HM]     aff[0]=ff
[HM]     flags=0 smc-switch=0 ca=9177 prefer-ca=9177
[HM] Registers dump:
[HM] ----------
[HM] 64 bits userspace stack dump:
[HM] ----------
[HM] <memset+0xc/0xc8>
[HM] <gf_lib_secspi_write_flash>+0x264/0x2e8
[HM] <flash_deep_sleep>+0x70/0xb0
[HM] <lib_sync_sensor_info>+0x128/0xb64
[HM] <func_init_sensor>+0x850/0x8c4
[HM] <fp_init_sensor>+0x170/0x5c0
[HM] <fpc_ta_init>+0xac/0x2c8
[HM] <TA_fp_tee_init>+0x78/0xc8
[HM] <tee_task_entry>+0x7f0/0x868
[HM] <thread_func_wrapper>+0x34/0x58
[HM] Dump task states END
[HM]

[HM] [ERROR][2171]vmem_as_ondemand_prepare failed
[HM] [ERROR][2496]process 2200000036 (tid: 54) data abort: 
[HM] [ERROR][2498]Bad memory access on address: 0x1, fault_code: 0x92000006
[HM] 
[HM] Dump task states for tcb
[HM] ----------
[HM]     name=[TA_uDFingerPrin] tid=54 is-idle=0 is-curr=0
[HM]     state=BLOCKED@MEMFAULT sched.pol=0 prio=46 queued=1
[HM]     aff[0]=ff
[HM]     flags=0 smc-switch=0 ca=9179 prefer-ca=9179
[HM] Registers dump:
[HM] ----------
[HM] 64 bits userspace stack dump:
[HM] ----------
[HM] <memcpy+0x30/0x344>
[HM] <gf_lib_secspi_read_flash>+0x240/0x2e8
[HM] <flash_load_info>+0x68/0x17c
[HM] <flash_check_flash_version>+0x88/0x348
[HM] <lib_sync_sensor_info>+0x24c/0xb64
[HM] <func_init_sensor>+0x850/0x8c4
[HM] <fp_init_sensor>+0x170/0x5c0
[HM] <fpc_ta_init>+0xac/0x2c8
[HM] <TA_fp_tee_init>+0x78/0xc8
[HM] <tee_task_entry>+0x7f0/0x868
[HM] <thread_func_wrapper>+0x34/0x58
[HM] Dump task states END
[HM]

受影响的设备¶

我们验证了这些漏洞是否影响了以下设备：

麒麟990：P40 专业版（ELS）

请注意，其他型号可能已受到影响。

补丁¶

名字	严厉	CVE漏洞	补丁
参数缓冲区溢出`TA_fp_tee_get_indices`	高	CVE-2022-46316 漏洞	2022 年 12 月
代码指针泄漏`lib_sync_sensor_info`	低	不适用	固定
访问全局变量时缺少锁定	低	不适用	固定