CVE-2018-9463 - Out-of-Bounds Write in `touch_sw49408.c` Leads to Local Privilege Escalation

A critical security vulnerability known as CVE-2018-9463 affects several Android devices due to a bug in the touch controller driver (touch_sw49408.c). This flaw allows a local attacker to potentially gain system-level privileges because of an out-of-bounds (OOB) write in the function responsible for interrupt runtime engine debugging (sw49408_irq_runtime_engine_debug). This article breaks down the root cause, shows how exploitation can work, and offers links to key references.

What Is CVE-2018-9463?

On affected devices, the Synaptics touch screen controller driver, specifically the SW49408 series, exposes a sysfs debug interface. A misimplemented bounds check in the sw49408_irq_runtime_engine_debug function means a local attacker can overwrite memory outside of its intended buffer, which may corrupt kernel memory, escalate privileges, or even execute arbitrary code with *System* rights.

Let’s look at the vulnerable code in touch_sw49408.c (excerpted and simplified)

static ssize_t sw49408_irq_runtime_engine_debug(struct device *dev, struct device_attribute *attr, const char *buf, size_t count) {
    char debug_buf[100];
    size_t len = count;

    if (len > sizeof(debug_buf))
        len = sizeof(debug_buf); // Off-by-one bug: should be sizeof(debug_buf) - 1

    memcpy(debug_buf, buf, len); // Potential out-of-bounds write!

    // ... further code that acts on debug_buf ...
}

Problem:
The code obliviously copies count bytes (the input buffer length) into debug_buf, which is only 100 bytes. The bounds check is faulty—if count is exactly 100, a full 100 bytes are copied, but arrays in C are -indexed, so the maximum safe index is 99. If the input length is not sanitized, this leads to an off-by-one out-of-bounds write, which the attacker can manipulate.

Exploit Details

Since the affected function is registered to a sysfs debug interface and is accessible with system privileges, an attacker could:

1. Write Malicious Data: Prepare a buffer of 100+ bytes crafted to overwrite control structures adjacent to debug_buf.
2. Trigger the OOB Write: Use echo or another method to write the buffer to the sysfs debug file (e.g., /sys/devices/.../sw49408_debug).
3. Hijack Execution: If the overwritten memory region contains function pointers or sensitive kernel data, the attacker could redirect execution flow or corrupt critical information—effectively escalating privileges or executing code in kernel context.

Proof of Concept (PoC)

*Disclaimer: The following is educational and simplified, do NOT use destructively.*

# As SYSTEM or via a vulnerable app on affected Android device
python -c 'print("A" * 1024)' > /sys/devices/virtual/input/inputX/sw49408_debug

Replace inputX with the correct input device path. This oversized write can trigger the vulnerability.

Mitigation & Patch

The security patch tightens the bounds check and may switch to a safer routine such as strncpy or limit the copy properly:

if (len >= sizeof(debug_buf))
    len = sizeof(debug_buf) - 1;
memcpy(debug_buf, buf, len);
debug_buf[len] = '\'; // Null-terminate

Make sure your device is running a firmware version with the updated driver.

References

- Android Security Bulletin - November 2018
- CVE Details for CVE-2018-9463
- Synaptics Touch Controller Security Advisories
- Google Issue Tracker Report (archived)

Conclusion

CVE-2018-9463 is a real-world example of how a simple off-by-one error in kernel code can place the entire security of a device at risk. Local attackers—potentially even a malicious app with escalated privileges—could leverage this bug to gain full system control. Always update your devices and audit kernel code involving user input, especially in debug interfaces.

Timeline

Published on: 12/05/2024 00:15:18 UTC
Last modified on: 12/05/2024 16:15:19 UTC