[RESTRICT AUTOMERGE] CTS test for Android Security b/129768470
Bug: 129768470
Bug: 132698644
Test: Ran the new testcase on android-8.1.0_r38 to test with/without patch
Change-Id: Ie85776392f9224c74f947f3c70e7c7864ae2b64f
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2115/Android.mk b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2115/Android.mk
new file mode 100644
index 0000000..317457f
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2115/Android.mk
@@ -0,0 +1,32 @@
+# Copyright (C) 2021 The Android Open Source Project
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+LOCAL_PATH := $(call my-dir)
+include $(CLEAR_VARS)
+
+LOCAL_MODULE := CVE-2019-2115
+LOCAL_SRC_FILES := poc.cpp
+LOCAL_MULTILIB := both
+LOCAL_MODULE_STEM_32 := $(LOCAL_MODULE)32
+LOCAL_MODULE_STEM_64 := $(LOCAL_MODULE)64
+LOCAL_C_INCLUDES := system/gatekeeper/include/gatekeeper/
+LOCAL_SHARED_LIBRARIES := libgatekeeper
+
+# Tag this module as a cts test artifact
+LOCAL_COMPATIBILITY_SUITE := cts sts vts
+LOCAL_CTS_TEST_PACKAGE := android.security.cts
+
+LOCAL_ARM_MODE := arm
+LOCAL_CFLAGS += -Wall -Werror
+include $(BUILD_CTS_EXECUTABLE)
diff --git a/hostsidetests/securitybulletin/securityPatch/CVE-2019-2115/poc.cpp b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2115/poc.cpp
new file mode 100644
index 0000000..b7db2f6
--- /dev/null
+++ b/hostsidetests/securitybulletin/securityPatch/CVE-2019-2115/poc.cpp
@@ -0,0 +1,119 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#define private public
+
+#include "gatekeeper.h"
+#include "../includes/common.h"
+
+using namespace gatekeeper;
+
+bool isVulnerable = false;
+const uint8_t *authTokenKey = nullptr;
+
+void * operator new(decltype(sizeof(0)) n) noexcept(false) {
+ return malloc(n);
+}
+
+void operator delete(void * ptr) throw () {
+ if (ptr == authTokenKey) {
+ isVulnerable = true;
+ }
+ if (!ptr) {
+ free(ptr);
+ }
+}
+
+class DerivedGateKeeper : public GateKeeper {
+ protected:
+ bool GetAuthTokenKey(const uint8_t **auth_token_key,
+ uint32_t *length __attribute__((unused))) const {
+ *auth_token_key = (const uint8_t*)(new uint8_t());
+ authTokenKey = *auth_token_key;
+ return true;
+ }
+ void GetPasswordKey(const uint8_t **password_key __attribute__((unused)),
+ uint32_t *length __attribute__((unused))) {
+ }
+ void ComputePasswordSignature(
+ uint8_t *signature __attribute__((unused)),
+ uint32_t signature_length __attribute__((unused)),
+ const uint8_t *key __attribute__((unused)),
+ uint32_t key_length __attribute__((unused)),
+ const uint8_t *password __attribute__((unused)),
+ uint32_t password_length __attribute__((unused)),
+ salt_t salt __attribute__((unused))) const {
+ }
+ void GetRandom(void *random __attribute__((unused)),
+ uint32_t requested_size __attribute__((unused))) const {
+ }
+ void ComputeSignature(uint8_t *signature __attribute__((unused)),
+ uint32_t signature_length __attribute__((unused)),
+ const uint8_t *key __attribute__((unused)),
+ uint32_t key_length __attribute__((unused)),
+ const uint8_t *message __attribute__((unused)),
+ const uint32_t length __attribute__((unused))) const {
+ }
+ uint64_t GetMillisecondsSinceBoot() const {
+ return EXIT_SUCCESS;
+ }
+ bool GetFailureRecord(uint32_t uid __attribute__((unused)),
+ secure_id_t user_id __attribute__((unused)),
+ failure_record_t *record __attribute__((unused)),
+ bool secure __attribute__((unused))) {
+ return false;
+ }
+ bool ClearFailureRecord(uint32_t uid __attribute__((unused)),
+ secure_id_t user_id __attribute__((unused)),
+ bool secure __attribute__((unused))) {
+ return false;
+ }
+ bool WriteFailureRecord(uint32_t uid __attribute__((unused)),
+ failure_record_t *record __attribute__((unused)),
+ bool secure __attribute__((unused))) {
+ return false;
+ }
+ uint32_t ComputeRetryTimeout(
+ const failure_record_t *record __attribute__((unused))) {
+ return EXIT_SUCCESS;
+ }
+ virtual bool IsHardwareBacked() const {
+ return false;
+ }
+ bool DoVerify(
+ const password_handle_t *expected_handle __attribute__((unused)),
+ const SizedBuffer &password __attribute__((unused))) {
+ return false;
+ }
+};
+
+int main() {
+ UniquePtr < uint8_t > auth_token = UniquePtr < uint8_t > (new uint8_t());
+ uint32_t *length = (uint32_t*) malloc(sizeof(uint32_t));
+ uint64_t timestamp = 1;
+ secure_id_t user_id = 1;
+ secure_id_t authenticator_id = 1;
+ uint64_t challenge = 0;
+
+ DerivedGateKeeper *object = new DerivedGateKeeper();
+ object->MintAuthToken(&auth_token, length, timestamp, user_id,
+ authenticator_id, challenge);
+
+ const uint8_t* auth_token_tmp = auth_token.release();
+ delete auth_token_tmp;
+ delete object;
+ return (isVulnerable) ? EXIT_VULNERABLE : EXIT_SUCCESS;
+}
diff --git a/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2115.java b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2115.java
new file mode 100644
index 0000000..38c8be0
--- /dev/null
+++ b/hostsidetests/securitybulletin/src/android/security/cts/CVE_2019_2115.java
@@ -0,0 +1,37 @@
+/**
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.security.cts;
+
+import android.platform.test.annotations.SecurityTest;
+import com.android.tradefed.device.ITestDevice;
+import com.android.tradefed.testtype.DeviceJUnit4ClassRunner;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+@RunWith(DeviceJUnit4ClassRunner.class)
+public class CVE_2019_2115 extends SecurityTestCase {
+
+ /**
+ * b/129768470
+ * Vulnerability Behaviour: EXIT_VULNERABLE (113)
+ */
+ @SecurityTest(minPatchLevel = "2019-09")
+ @Test
+ public void testPocCVE_2019_2115() throws Exception {
+ AdbUtils.runPocAssertNoCrashesNotVulnerable("CVE-2019-2115", null, getDevice());
+ }
+}
