In mid-2022, a significant vulnerability was reported in the Android ecosystem: CVE-2022-32602. It exists in the keyinstall component used for Key Management (likely in MediaTek-based devices). This bug is critical because it could allow rogue apps or processes on the device to access sensitive data stored elsewhere in memory—without root access and without any user interaction. In this post, we'll break down what went wrong, how exploitation works, share code snipplets, and provide links to official patches and references.

Cause: Missing bounds check when accessing arrays or memory

- Impact: Local attackers can read memory they shouldn't be able to and potentially leak user data or cryptographic keys.
- Requirements: The attacker needs to run code locally (no extra privileges or user clicks needed).

Technical Breakdown: What Happened?

At its core, an out-of-bounds read happens when a program reads data outside the limits of what it should have access to. In the keyinstall process, a function fails to check if an index or length is within proper range before reading from an array or buffer. Here’s a simplified version of what that might look like:

// Example code snipplet (vulnerable pseudo-code in C)
void process_key_data(uint8_t *data, size_t size) {
    uint8_t key_buffer[256]; // intended buffer

    // Vulnerability: no check if size > 256
    memcpy(key_buffer, data, size); // Out-of-bounds read if size > sizeof(key_buffer)
}

If the attacker can control the size parameter, they could cause the function to read beyond the valid memory region, leaking extra data from the stack or heap. Depending on what’s stored in adjacent memory, this could lead to cryptographic key leakage, user credentials, or other private info.

Exploit Details

Exploitation is straightforward:
An app or process on the device that calls the affected keyinstall function can craft a request with an oversized size or index value. No root or special permissions needed.

Steps to Exploit

1. Malicious local app crafts a call to keyinstall with a branch or parameter triggering the out-of-bounds read.

Function executes and reads beyond actual data limits.

3. Extra memory content unintentionally gets returned to the attacker (could be in a response, log, or file).

A conceptual exploit in C (for a local process)

// Attacker-controlled code
uint8_t attacker_buffer[512] = {};
// intentionally large size, causes out-of-bounds in keyinstall
size_t attack_size = 400; 

process_key_data(attacker_buffer, attack_size);
// Now key_buffer contains 400 bytes, 144 of which are out-of-bounds

Note: Real code will depend on the system’s implementation, so check the official advisories and technical docs for your platform.

How Did They Fix It?

The fix is about adding proper bounds checks to ensure that no function can ever read (or write) beyond a buffer’s size. See the (simplified) patched pseudo-code:

#define MAX_KEY_SIZE 256

void process_key_data(uint8_t *data, size_t size) {
    uint8_t key_buffer[MAX_KEY_SIZE];

    if (size > MAX_KEY_SIZE) {
        // Don't read data or log-and-return error
        return ERROR;
    }
    // Safe!
    memcpy(key_buffer, data, size);
}

- Android Security Bulletin: Google - June 2022
- NVD CVE Entry: CVE-2022-32602 at NVD
- MediaTek Security Bulletin: MediaTek Security Advisories

Issue ID: ALPS07388790

For detailed patch code, check your device manufacturer’s updates, or the AOSP (Android Open Source Project) repository if publicly available.

What Should You Do?

- Update your Android device as soon as you can. This issue is addressed in security updates from summer 2022 onward.

Avoid installing unknown or untrustworthy apps.

- Device manufacturers should test for out-of-bounds and similar memory safety errors in all security/reliant components.

Conclusion

CVE-2022-32602 exemplifies how simple coding mistakes (like missing bounds checks) can have outsized impacts, especially in components managing sensitive data. Make sure your devices are updated and developers protect all inputs. Want to learn more about Android security? Check the security bulletins and subscribe to updates!

Timeline

Published on: 11/08/2022 21:15:00 UTC
Last modified on: 11/09/2022 18:03:00 UTC