bluefrostsecurity/cve-2020-0041

Exploits for Android Binder bug CVE-2020-0041

CVE-2020-0041

This repository contains code for exploiting CVE-2020-0041, a bug we reported to Google in Decmeber 2019 and was fixed in the Android Security Bulletin from March 2020.

You can find the sandbox escape exploit in sandbox/. The analysis of the bug and exploitation approach can be found at https://labs.bluefrostsecurity.de/blog/2020/03/31/cve-2020-0041-part-1-sandbox-escape/ .

Similarly, you can find the privilege escalation exploit in lpe/. The exploitation approach for this part can be found at https://labs.bluefrostsecurity.de/blog/2020/04/08/cve-2020-0041-part-2-escalating-to-root/ .

cve-2020-0041's Issues

Help getting offset

Hi can you help me get my boot.img offset? I tried the exploit that came from you which was changed by j4nn and got the result

[+] Detected SO-04K-52.1.B.0.188 target
[+] Mapped 200000
[+] selinux_enforcing before exploit: 1
[+] pipe file: 0xffffffc2db090700
[+] file epitem at ffffffc2018dfb80
[+] Reallocating content of 'write8_inode' with controlled data.......[DONE]
[+] Overwriting 0xffffffc2db090720 with 0xffffffc2018dfbd0...[DONE]
[+] Write done, should have arbitrary read now.
[+] file operations: ffffff8f56e1ebf8
[+] kernel base: ffffff8f55c80000
[+] Reallocating content of 'write8_selinux' with controlled data.....[DONE]
[+] Overwriting 0xffffff8f58090000 with 0x0...[DONE]
[+] init_cred: ffffff8f57e2fcd0
[+] memstart_addr: 0x6e656c282074656b
[+] First level entry: 12eff9003 -> next table at ffffffd90e8b2a95

then the phone reboots by itself, so I guess if I use the correct offset it will get better results.
I uploaded my kernel here...

Root for mi10pro?

Can anyone try to move this exploit use to root mi10pro?

Required key not available

Hi, the exploit perfectly works on Pixel 3, I have a question about the following error when I try to create a new file:

What is the issue? Is it related to some kernel enforcement?
Is it possible to bypass it? (Pixel 3 blueline)
Thank you in advance

Adapting code

Hi! I try to make this program working for another device(Huawei P30 Pro).
As I understood, I need to change offsets and kernel magic(exploit.c). Am I right?
If so, how did you get this offsets?

how to build sc.bin

/data/local/tmp/injector pid /data/local/tmp/sc.bin
how to build sc.bin from source code. The source code of sc.bin seems to be different from main.diff format。
Thanks.