GCVE-1988-2026-0417

checksec:

$ checksec --file Sofia
[*] '/redacted/Sofia'
    Arch:       arm-32-little
    RELRO:      No RELRO
    Stack:      Canary found
    NX:         NX unknown - GNU_STACK missing
    PIE:        No PIE (0x8000)
    Stack:      Executable
    RWX:        Has RWX segments

this ones interesting. sofia uses an internal flash fs called WFS. per
an online search:

WFS is a proprietary filesystem developed by Hikvision for its Network
Video Recorders (NVRs) and Digital Video Recorders (DVRs).
 [1] 
(https://www.ufsexplorer.com/ufs-explorer-video-recovery/?srsltid=AfmBOooXEaS7QruR5OQybE2P_I37nUcCgNEqXv09ZCzdtqv211_fx8DL)
 How it works: Instead of formatting hard drives or flash storage with
general-purpose filesystems (like FAT32 or NTFS),
  Hikvision devices write video data directly to the storage media
using WFS. [1] 
(https://www.ufsexplorer.com/ufs-explorer-video-recovery/?srsltid=AfmBOooXEaS7QruR5OQybE2P_I37nUcCgNEqXv09ZCzdtqv211_fx8DL)
  Purpose: This design minimizes fragmentation and maximizes
data-writing speeds for 24/7 video streams.

  Note: Because it is proprietary, standard computers
(Windows/Mac/Linux) cannot natively read a WFS-formatted drive. Data
recovery professionals use specialized tools like UFS Explorer to
reconstruct and extract videos from these drives. [1]
(https://www.ufsexplorer.com/ufs-explorer-video-recovery/?srsltid=AfmBOooXEaS7QruR5OQybE2P_I37nUcCgNEqXv09ZCzdtqv211_fx8DL)
ok whatever that means. anyway, per some existing research, wfs holds
a block buffer cache, which is a pool of 128 buffers that hold ru’d
512-byte flash blocks in ram. each buffer has a refcount that tracks
how many threads are using it. then once refcount is 0 obv we free it
and it can be recycled.

one of the functions that handle this (per the proximity browser) is

int __fastcall sub_5B8BE8(int result)
{
  int v1; // r3

  if ( result )
  {
    v1 = *(unsigned __int8 *)(result + 18);
    *(_BYTE *)(result + 18) = v1 - 1;
    if ( !v1 )
      return sub_5A882C("Trying to free free buffer\n");
  }
  return result;
}
interestingly it does warn if v1 (if the buffer doesnt exist) is free
that a double free is happening. it doesnt actually do anything about
it however. also since this is multithreaded, there is a clear as day
toctou. the same can be seen for looking up an entry and refcount
incrementing:

int __fastcall sub_5B8C10(int a1, __int64 a2)
{
  int i; // r1

  for ( i = dword_AD2DB4[(unsigned __int8)a2]; i; i = *(_DWORD *)(i + 24) )
  {
    if ( *(_DWORD *)i == a1 && *(_QWORD *)(i + 8) == a2 )
    {
      ++*(_BYTE *)(i + 18);
      return i;
    }
  }
  return i;
}
again, no locking. this could mean we could get a toctou and
consequently a uaf vuln. maybe if we fuck with this carefully and look
at the fields we could potentially get arb r/w.

after researching online the struct layout looks like this:

struct {
    int device_no;
    // ??? size 4
    uint64_t block_number;
    uint8_t uptodate;
    uint8_t dirty;
    uint8_t refcount;
    uint8_t paddingidk;
    uintptr_t hash_prev;
    uintptr_t hash_next;
    uintptr_t lru_prev;
    uintptr_t lru_next;
    uintptr_t dataptr;
}
unfortunately i couldnt give a fuck about actualyl exploiting it, but
there is a chance someone could just use the ptrs to leak stuff if
youre careful enough. this struct is 40 bytes big, and there are
allocations of similar size with controllable data. youll have to
groom allocations so these two threads get to play with the buffer
properly instead of getting some random buffre.

to exploit this (by theory):

have thread x do a lookup. it finds your target buf and incremenmts
refcount and returns a ptr to the buffer.
have another thread decrement at the right time to race with thread x.
refcount is now 0, even though thread x is holding it.
the other thread gets a new buffer, walking along the lru linked list
to find a buffer with refcount 0. it finds thread x’s buffer, sets
refcount to 1, evicts it and repurposes it for a different block.
uaf, nice. we can now write stuff over the stale ref.
the buffer eviction logic:

int __fastcall sub_5B8C64(int a1, __int64 a2)
{
  int result; // r0
  int v6; // r10
  int v7; // r3
  int v8; // r2
  int v9; // r3
  int v10; // r2
  int v11; // r3
  int v12; // r1

  while ( 1 )
  {
    result = sub_5B8C10(a1, a2);
    if ( result )
      break;
    v6 = dword_9D8750;
    while ( *(_BYTE *)(v6 + 18) )
    {
      v6 = *(_DWORD *)(v6 + 32);
      if ( v6 == dword_9D8750 )
        return 0;
    }
    *(_BYTE *)(v6 + 18) = 1;
    v7 = *(_DWORD *)(v6 + 24);
    if ( v7 )
      *(_DWORD *)(v7 + 20) = *(_DWORD *)(v6 + 20);
    v8 = *(_DWORD *)(v6 + 20);
    if ( v8 )
      *(_DWORD *)(v8 + 24) = v7;
    v9 = *(unsigned __int8 *)(v6 + 8);
    if ( dword_AD2DB4[v9] == v6 )
      dword_AD2DB4[v9] = *(_DWORD *)(v6 + 24);
    if ( !*(_DWORD *)(v6 + 28) || !*(_DWORD *)(v6 + 32) )
      sub_5A882C("Free block list corrupted");
    v10 = *(_DWORD *)(v6 + 28);
    *(_DWORD *)(v10 + 32) = *(_DWORD *)(v6 + 32);
    v11 = *(_DWORD *)(v6 + 32);
    *(_DWORD *)(v11 + 28) = v10;
    if ( dword_9D8750 == v6 )
      dword_9D8750 = v11;
    if ( *(_BYTE *)(v6 + 17) )
      sub_5B8AE8(v6);
    *(_BYTE *)(v6 + 17) = 0;
    *(_BYTE *)(v6 + 16) = 0;
    v12 = dword_AD2DB4[(unsigned __int8)a2];
    *(_DWORD *)v6 = a1;
    *(_QWORD *)(v6 + 8) = a2;
    while ( 1 )
    {
      if ( !v12 )
      {
        sub_5B8A8C(v6);
        return v6;
      }
      if ( *(_DWORD *)v12 == a1 && *(_QWORD *)(v12 + 8) == a2 )
        break;
      v12 = *(_DWORD *)(v12 + 24);
    }
    *(_DWORD *)v6 = 0;
    *(_QWORD *)(v6 + 8) = 0;
    *(_BYTE *)(v6 + 18) = 0;
    sub_5B8A8C(v6);
  }
  return result;
}
so from here, we can see some interesting stuff. nmotably, we can see

 if ( !*(_DWORD *)(v6 + 28) || !*(_DWORD *)(v6 + 32) )
      sub_5A882C("Free block list corrupted");
    v10 = *(_DWORD *)(v6 + 28);
    *(_DWORD *)(v10 + 32) = *(_DWORD *)(v6 + 32);
    v11 = *(_DWORD *)(v6 + 32);
    *(_DWORD *)(v11 + 28) = v10;
    if ( dword_9D8750 == v6 )
given the context and the vairables being reused, we can probably guess:

 if ( !*(_DWORD *)(v6 + 28) || !*(_DWORD *)(v6 + 32) )
      sub_5A882C("Free block list corrupted");
    prev = *(_DWORD *)(v6 + 28);
    *(_DWORD *)(prev + 32) = *(_DWORD *)(v6 + 32);
    next = *(_DWORD *)(v6 + 32);
    *(_DWORD *)(next + 28) = prev;
    if ( dword_9D8750 == v6 )
so, we read buf->lru_prev, set prev->lru_next to buf->lru_next, read
buf->lru_next, then next->lru_prev = buf->lru_prev. if you have
skidded before, this is an unsafe unlink, since theres no validation
whatsoever on the ptrs. this means if you control buf+28 and buf+32 we
can get an arbitrary write. from there, we cna probably chain this to
eventually get an arbitrary read, amybe overwrite a got entry, etc
etc.
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

GCVE-1988-2026-0417

UAF in XMEye Security Camera

Description (en)

References