1 /* 2 * Copyright (C) 2022 The Android Open Source Project 3 * 4 * Licensed under the Apache License, Version 2.0 (the "License"); 5 * you may not use this file except in compliance with the License. 6 * You may obtain a copy of the License at 7 * 8 * http://www.apache.org/licenses/LICENSE-2.0 9 * 10 * Unless required by applicable law or agreed to in writing, software 11 * distributed under the License is distributed on an "AS IS" BASIS, 12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 * See the License for the specific language governing permissions and 14 * limitations under the License. 15 */ 16 17 18 package android.security.cts; 19 20 import android.platform.test.annotations.AsbSecurityTest; 21 22 import com.android.sts.common.tradefed.testtype.NonRootSecurityTestCase; 23 import com.android.sts.common.util.TombstoneUtils; 24 import com.android.sts.common.util.TombstoneUtils.Config.BacktraceFilterPattern; 25 import com.android.tradefed.testtype.DeviceJUnit4ClassRunner; 26 27 import org.junit.Test; 28 import org.junit.runner.RunWith; 29 30 import java.util.regex.Pattern; 31 32 @RunWith(DeviceJUnit4ClassRunner.class) 33 public class CVE_2018_9558 extends NonRootSecurityTestCase { 34 35 /** 36 * b/112161557 37 * Vulnerability Behaviour: SIGABRT in self 38 * Vulnerable Library: libnfc-nci (As per AOSP code) 39 * Vulnerable Function: rw_t2t_handle_tlv_detect_rsp (As per AOSP code) 40 */ 41 @Test 42 @AsbSecurityTest(cveBugId = 112161557) testPocCVE_2018_9558()43 public void testPocCVE_2018_9558() throws Exception { 44 AdbUtils.assumeHasNfc(getDevice()); 45 assumeIsSupportedNfcDevice(getDevice()); 46 pocPusher.only64(); 47 String[] signals = {TombstoneUtils.Signals.SIGABRT}; 48 String binaryName = "CVE-2018-9558"; 49 AdbUtils.pocConfig testConfig = new AdbUtils.pocConfig(binaryName, getDevice()); 50 testConfig.config = new TombstoneUtils.Config().setProcessPatterns(Pattern.compile(binaryName)) 51 .setBacktraceIncludes(new BacktraceFilterPattern("libnfc-nci", 52 "rw_t2t_handle_tlv_detect_rsp")); 53 testConfig.config 54 .setBacktraceExcludes(new BacktraceFilterPattern("libdl", "__cfi_slowpath")); 55 testConfig.config.setSignals(signals); 56 AdbUtils.runPocAssertNoCrashesNotVulnerable(testConfig); 57 } 58 } 59