[CVE-2013-3685][Root]Multiple LG Android devices, Sprite Software Backup - Security Discussion
Subject:
Race condition in Sprite Software's backup software, installed by OEM on LG Android devices.
Author:
Justin Case - [email protected]
CVE ID:
CVE-2013-3685
Effect:
Locally exploited vulnerability with minimal device user interaction which results in executing code as the root user. Under specific circumstances, it is possible to exploit this vulnerability without the device user's knowledge
Products:
"Backup"
"spritebud"
Vendors:
Sprite Software
LG Electronics
Potentially other vendors
Affected Versions:
spritebud 1.3.24
backup 2.5.4105
Likely others versions as well
Affected Devices (Subject to firmware configuration):
LG-E971 LG Optimus G
LG-E973 LG Optimus G
LG-E975 LG Optimus G
LG-E975K LG Optimus G
LG-E975T LG Optimus G
LG-E976 LG Optimus G
LG-E977 LG Optimus G
LG-F100K LG Optimus Vu
LG-F100L LG Optimus Vu
LG-F100S LG Optimus Vu
LG-F120K LG Optimus Vu
LG-F120L LG Optimus LTE Tag
LG-F120S LG Optimus LTE Tag
LG-F160K LG Optimus LTE 2
LG-F160L LG Optimus LTE 2
LG-F160LV LG Optimus LTE 2
LG-F160S LG Optimus LTE 2
LG-F180K LG Optimus G
LG-F180L LG Optimus G
LG-F180S LG Optimus G
LG-F200K LG Optimus Vu 2
LG-F200L LG Optimus Vu 2
LG-F200S LG Optimus Vu 2
LG-F240K LG Optimus G Pro
LG-F240L LG Optimus G Pro
LG-F240S LG Optimus G Pro
LG-F260K LG Optimus LTE 3
LG-F260L LG Optimus LTE 3
LG-F260S LG Optimus LTE 3
LG-L21 LG Optimus G
LG-LG870 LG (Unknown)
LG-LS860 LG Mach
LG-LS970 LG Optimus G
LG-P760 LG Optimus L9
LG-P769 LG Optimus L9
LG-P780 LG Optimus L7
LG-P875 LG Optimus F5
LG-P875h LG Optimus F5
LG-P880 LG Optimus 4X HD
LG-P940 LG Prada
LG-SU540 LG Prada 3.0
LG-SU870 LG Optimus 3D Cube
LG-US780 LG Lollipop
Potentially other devices as well.
Product Information:
"Backup" and "spritebud" are a setting and application backup/restore system written by Sprite Software and deployed on LG Android smartphones. "Backup" is the end user front end app, and "spritebud" is the service that preforms the backup and restore functions.
Details:
The "spritebud" daemon is started by the init scripts and runs as the root user. Listening on a unix socket, the daemon accepts instructions from the "Backup" app. Using a crafted backup, we can write to, change permission and change ownership of any file, being that "spritebud" is running under the root user.
The crafted backup contains restore data for our exploiting application, "com.cunninglogic.lgpwn". The data includes a 50mb dummy file (a) used to increase our exploit window, su binary (b), a script (c) to install su, and a text file (d) containing the path to our script. All files are owned by the application, and are world write/read/execute. All files are restored in alphabetical order. The entire backup, after compress, is approximately 2mb. The structure of this backup is as follows:
drwxrwxrwx u0_a114 u0_a114 2013-05-28 20:13 files
./files:
- -rwxr-xr-x u0_a114 u0_a114 52428800 2013-05-22 20:06 a
- -rwxr-xr-x u0_a114 u0_a114 91992 2013-05-22 20:07 b
- -rwxr-xr-x u0_a114 u0_a114 251 2013-05-22 20:12 c
- -rwxr-xr-x u0_a114 u0_a114 42 2013-05-22 20:07 d
Prior to restoration, our exploit app runs, watches the process and waits. During restoration, the spritebud daemon first creates the files directory, then sets it's permission and owner. Next it decompresses and restores the "a" file, our 50mb dummy files. During the restoration of "a", our exploit application has time to symlink "d", our text file containing the full path to our script (c), to /sys/kernel/uevent_helper. Upon restoration of file "d", our path is written to uevent_helper. When a hotplug even occurs (which occur every few seconds), the path contained in uevent_helper is execute by the kernel and our script (c) is executed and installs the su binary (b).
Amazing Work
Great work jcase !! :good: I successfully rooted T-mobile USA p769 20d version.. Tried to see if I had spritebud with terminal emulator which got no file found. Downloaded the pwn apk and decided to try anyways. Followed the backup / recovery steps. Phone rebooted by itself. Downloaded root checker with successful root result .. Props !!!
Worked awesome, thanks! What's your email for PayPal?
Sent from my LG-P769 using Tapatalk 2
TheCoutures said:
Worked awesome, thanks! What's your email for PayPal?
Sent from my LG-P769 using Tapatalk 2
Click to expand...
Click to collapse
[email protected], but its not a requirement at all
jcase said:
[email protected], but its not a requirement at all
Click to expand...
Click to collapse
Neither is the work, donation made, enjoy a beer or a cheap American six pack on me, ha.
Sent from my LG-P769 using Tapatalk 2
So this doesnt work on LG Motion (MS770)
Backup version: 2.4.0.4042
Sprite version...how do you find that??
Sent from my LG-MS770 using Tapatalk 2
TheCoutures said:
Neither is the work, donation made, enjoy a beer or a cheap American six pack on me, ha.
Sent from my LG-P769 using Tapatalk 2
Click to expand...
Click to collapse
Thanks, will end up being pizza or ice cream for the kids
I have spritebud and jellybean, but this just isn't working.
LG P769
CurlyCoconutTree said:
I have spritebud and jellybean, but this just isn't working.
LG P769
Click to expand...
Click to collapse
What does it do/say
Great! It just works. Thanks man. And btw,smart move.
P.S. -Is this related to the recently discovered security hole in Android?
Sent from my LG-P760 using Tapatalk 2
Hello Jcase, first of all i am a total noob to this so sorry if i dont know how to make it work, but when i try to open the file it starts properly and when i click rootme the program returns with the backup has stopped and reboot my phone. what am i doing wrong?
My phone is a LG-F180S and i would love to get it rooted, i just bought this phone from a Korean and want to change it to the E975 version, been reading a lot of threads and tried a lot of rooting but nothing works.
Hope u can help me out,
Thx in advance
NOOB like me...
Thank you,Thank you,Thank you,!!!
I am finally rooted...you are a GENIUS!
If a NOOB like me can root my T-mobile LG P769 , anyone can..lol
I just got this phone a week ago, and have been trying everything out there to get it rooted & your method finally worked.
Any good ideas on what to do now? I'm a little nervous, this phone seems to be a lot harder to break than my LG Esteem was.
(was using LG Esteem MS910,fully rooted,debloated,DeVerTedRom V2, 2.6.35.7-LD-ZVD_Speed_Kernel [email protected]#1)
Specs:
Android version
4.1.2
Baseband Version
L6260_MODEM_SIC_01.1305.00
Kernel Version
3.0.31
Build number
JZ054K
Software version
P76920f
Once again, THANK YOU :highfive:
P76820F
Thanks a ton for uploading this, tried many methods of rooting ie: Lelus, SuperSu, etc. This worked so simply and with no need of previous experience. My LG Optimus L9 seemed impossible to root after the OTA to 20F Jelly Bean, thanks again for creating this wonderful application!
zviki said:
Great! It just works. Thanks man. And btw,smart move.
P.S. -Is this related to the recently discovered security hole in Android?
Sent from my LG-P760 using Tapatalk 2
Click to expand...
Click to collapse
No, this is entirely a flaw in Sprite Backup
If I wasn't a bum right now, I'd totally send a donation as thanks.
Sent from my LG-P769 using xda app-developers app
When i download SuperSu, I get an error that states "There is no SU binary installed, and SuperSU cannot install it. This is a problem"
I have the L9 L769
Ogre6473 said:
If I wasn't a bum right now, I'd totally send a donation as thanks.
Sent from my LG-P769 using xda app-developers app
Click to expand...
Click to collapse
Yet somehow you have a smartphone, this never made any sense to me.
Sent from my LG-P769 using Tapatalk 2
Still no success.
After 3 weeks of attempts, I have yet to root my L9 P769. I've had to live with my phone with an uncalibrated screen for much too long now. What was promised to be an easy task, has proven to be a huge mistake on my part. My friend was the one that convinced me to root my phone, and he was the one that wanted to root it. To make a long story short, he left me with an awesome phone that I cannot use to it's full potential. Not even half of it.
I have tried to figure this out on my own by reading through endless amounts of forums, and my main issue seems to be the dead links to the software I require to root my phone. I am beyond desperate to fix my phone, I have considered claiming it stolen to have it replaced with my insurance.
I have the LG Optimus L9 P769 10g ICS.
I am currently having an issue with the SuperSU. I would love any help.
Knotsea said:
After 3 weeks of attempts, I have yet to root my L9 P769. I've had to live with my phone with an uncalibrated screen for much too long now. What was promised to be an easy task, has proven to be a huge mistake on my part. My friend was the one that convinced me to root my phone, and he was the one that wanted to root it. To make a long story short, he left me with an awesome phone that I cannot use to it's full potential. Not even half of it.
I have tried to figure this out on my own by reading through endless amounts of forums, and my main issue seems to be the dead links to the software I require to root my phone. I am beyond desperate to fix my phone, I have considered claiming it stolen to have it replaced with my insurance.
I have the LG Optimus L9 P769 10g ICS.
I am currently having an issue with the SuperSU. I would love any help.
Click to expand...
Click to collapse
How did you get an uncalibrated screen were you trying to unlock the bootloader? how usable is it right now?
This is the method i used for rooting 10g. I had to read and execute a couple times to get the process right but all the software is provided in the thread.
And LG-P895 -_-
Sent from my LG-P895 using xda premium
---------- Post added at 09:57 PM ---------- Previous post was at 09:53 PM ----------
Did it will work wit LG Vu P895
Sent from my LG-P895 using xda premium
Related
[Q] LG thrill optimus 3d? will every rom/unlock/root work the same?
Just wondering im thinking about getting the LG thrill, would the root and cwm's work for it? Cause if thats the case cyanogenmod.com has some firmware ill just slap on this beast and be good to go
I've been asking the samething I just got the phone yesterday. When you root and install rom manager it comes up as optimus V so I'm stuck .. if you want to goforandroid clockworkmod.com you can somehow flash the LG Optimus 3d cwm but I don't know how nor do I want to brick my phone.. Sent from my LG-P925 using Tapatalk
I'd like to know as well.
Only difference that seems to be is some carriers use different frequencies but that seems odd, LGs listings match up 100% AFAIK and should just be a naming thing and perhaps branding. However ROOT should be no problem, flashing stuff like CustomROMs and CWM on the other hand could be dangerous if something isn't exactly the same but since Thrill just got out I'm guessing it will take a little while before a dev gets his hands dirty with one (since most that wanted one probably got a O3D instead). The reason ROM Manager shows up as Optimus V is that Thrill registers as that because of P925 and for some reason ROM Manager sees that as a Optimus V.
so do you think if i rename my device in the build prop from 295 to 290 it should flash the correct recovery for Optimus 3D? Oh, i have ATT's LG Thrill by the way.
Thrill users have flashed O3D Roms and they say it worked with no problems. Just fix the APN.
hi ups,do you flash your 925 with the 920's rom? i wonder
Virgin Mobile Root Question.
Virgin Mobile Root Question. It is time for me to upgrade my phone again and I was curious, which of the following phones are easiest to root, my last phone that I was able to root was the HTC Incredible (the LG Optimus Elite I could not). Also which of the following phones are any good. The last VM phone I got (optimus elite) sucks donkey balls. Here is the list of phones I am looking at, they all have OS 4.0 HTC Evo V (4G) HTC One V Samsung Galaxy Reverb Thanks In advance.
Heard the evo v is basically a revamped og evo. I just got the virgin optimus elite this past weekend rooted it in about ten minutes. The only ***** I've come across is finding a custom recovery for it
Moved to General Q&A.
Ken C said: Heard the evo v is basically a revamped og evo. I just got the virgin optimus elite this past weekend rooted it in about ten minutes. The only ***** I've come across is finding a custom recovery for it Click to expand... Click to collapse ya i used that APK root from another site, rooted it faster than it took to download it I used: [FAQ-GUIDE] ClockWorkMod Optimus Elite from androidforums
LG Optimus 3D Max - a few questions
Hi, First of all, I want to apologize for my "English" but I'm using www.translate.google.com If you renew on the sorry but I can not find anywhere answer to my problems. I want to buy a phone LG P720 Optimus 3D Max. But in my country there is no forum for this phone, so maybe here I find answers to my questions. 1.)It is possible to do "root" in this model? If so, I would ask for a link to the xda topic adequately. I found something like this http://forum.xda-developers.com/showthread.php?t=1886057 I can use this method? 2.)How to upload ROM? Is using the instructions for the model LG Optimus 3D P920 phone will destroy not? Alternatively, this method will work with the P720? http://forum.xda-developers.com/showthread.php?t=1244490 3.)There are already a ROM for your phone based on ICS? Or if I can upload the ROM for the P920 model? I found a guide on how to "przerobiać" ROM http://forum.xda-developers.com/showthread.php?t=1908008 You could use this means to convert P920 ROM to P720? Please bear with us and thank you for any help I greet Vienio_CzA
Vienio_CzA said: Hi, First of all, I want to apologize for my "English" but I'm using www.translate.google.com If you renew on the sorry but I can not find anywhere answer to my problems. 1.)I want to buy a phone LG P720 Optimus 3D Max. But in my country there is no forum for this phone, so maybe here I find answers to my questions. *2.)It is possible to do "root" in this model? If so, I would ask for a link to the xda topic adequately. I found something like this http://forum.xda-developers.com/showthread.php?t=1886057 I can use this method? 3.)How to upload ROM? Is using the instructions for the model LG Optimus 3D P920 phone will destroy not? Alternatively, this method will work with the P720? http://forum.xda-developers.com/showthread.php?t=1244490 4.)There are already a ROM for your phone based on ICS? Or if I can upload the ROM for the P920 model? I found a guide on how to "przerobiać" ROM http://forum.xda-developers.com/showthread.php?t=1908008 You could use this means to convert P920 ROM to P720? Please bear with us and thank you for any help I greet Vienio_CzA Click to expand... Click to collapse 1 ? 2 Yes 3 Yes 4 No and No
Yes it has been reported that the root method works but I don't know for myself Sent from my LG-P925 using xda app-developers app
wayno140 said: Yes it has been reported that the root method works but I don't know for myself Sent from my LG-P925 using xda app-developers app Click to expand... Click to collapse Hey ! I am the founder of ROOT METHOD for OPTIMUS 3D MAX And it works like CHARM CUSTOM ROM WILL BE AVAILABLE IN SOME DAYS BASED ON GINGERBREAD. But cannot say of ICS.
@defcomg Sorry for point 1, a small error crept in So, using the method of loading the LG P920 ROM with no damage to the phone? I'd rather be sure than later have problems with the service. But now I have another question, are there any ROM for the LG P720? If I understand you correctly that it is not possible to convert the LG P920 ROM? @Eklovya If you are the creator of this method is that you get so that the holder of the LG P720? And Romy from gingerbread only after some time will be available, and I can forget ics? I wonder why that fla P920 ROM does not work on the LG P720, as it's the same phone, just stronger? And frankly I hope that the world's largest Foum some users will be LG P720, and here I see that the phone is even less popular than in Poland. So maybe better to buy LG P920, better support for him It's nice that it was as if someone was so good and gave a link to the page where it is paired with the LG P720. How much is weaker than the LG P720 phone.
Vienio_CzA said: @defcomg Sorry for point 1, a small error crept in So, using the method of loading the LG P920 ROM with no damage to the phone? I'd rather be sure than later have problems with the service. But now I have another question, are there any ROM for the LG P720? If I understand you correctly that it is not possible to convert the LG P920 ROM? @Eklovya If you are the creator of this method is that you get so that the holder of the LG P720? And Romy from gingerbread only after some time will be available, and I can forget ics? I wonder why that fla P920 ROM does not work on the LG P720, as it's the same phone, just stronger? And frankly I hope that the world's largest Foum some users will be LG P720, and here I see that the phone is even less popular than in Poland. So maybe better to buy LG P920, better support for him It's nice that it was as if someone was so good and gave a link to the page where it is paired with the LG P720. How much is weaker than the LG P720 phone. Click to expand... Click to collapse I am having p725 , It is same as p720 just without NFC. And P920 is old but if you wanna go for a 3d phone with a good support you can go for p920. But just want to tell you that developer support and customers are not created in a day Its been 2 years since release.of p920 but p720 is recently released. It also has some users around 200. If you wanna search facebook lg optimus 3d maxx p720/p725 . You will get to know. Sent from my LG-P725 using xda premium
@Eklovya I do not know how in the world but in Poland this phone was released almost a year ago and still there is no ROM for it, and on the phone with the prior two years is even ICS, a little strange. How have you ROM on your phone? I'm afraid that if I want to buy LG P920 is right I will have to replace it because of poor performance, unless I'm wrong and 512MB RAM is enough? I've heard that you can tweak the processor to 1.2GMz, did it?
Buy P720 its newer and wait until developers make custom ROMS.
I do not want to be mean or anything, but the phone is on the market for almost a year, and there is not even a gingerbread ROM, let alone ICS? I understand it's a big lovable bear LG to blame for this state of affairs. I would prefer a newer model, but the idea that it will never likely, will not be given to me korzysztać of ICS is more inclined towards the LG P920.
If i was able to port ICS to P920 i m sure somebody will be able to port ICS to p720. Its simple like that.. If you think you cant take that risk, buy P920 that already has plenty of ROMS. If you think P920 is old and outdated dont buy it. The choice is yours to make. Your options are 4. 1) Is buy P920 because it already has plenty of ROMS. 2) Is buy P720 and wait until free custom ROMS are made. 3) Is buy any phone you like, find a Developer and PAY him to make you anything you like. 4) Dont buy LG.
Buy 870 and have official ICS and 16G internal memory too. Sent from my LG-SU870 using xda premium
xbsall said: If i was able to port ICS to P920 i m sure somebody will be able to port ICS to p720. Its simple like that.. If you think you cant take that risk, buy P920 that already has plenty of ROMS. If you think P920 is old and outdated dont buy it. The choice is yours to make. Your options are 4. 1) Is buy P920 because it already has plenty of ROMS. 2) Is buy P720 and wait until free custom ROMS are made. 3) Is buy any phone you like, find a Developer and PAY him to make you anything you like. 4) Dont buy LG. Click to expand... Click to collapse The best answer you can get... nice Xbsall
@Xbsall You do not understand me. While writing the previous post I meant is that so far there is not even gingerbread for LG P720. I'm not saying that you will never ICS for LG P720 but looking at the interest in this phone people like you, hope is small, because as I mentioned there are no, no ROM for this model. Although how that was one custom rom for the 720 is Bła by any chance, and so, you know. For updates to ICS from LG not count confidently: D I have a TV that's from 2011, and I know very well how LG treats its customers. Odwóch year promised to update the flash and he was so far gone. You write that I paid someone to do it for the LG P720 ICS.Ale first nikoga do not know what would have such made such an attempt, and secondly, the ROM would probably not develop a lot of bugs. I think that you have any contacts or something, you do not będęprosił because I know that, and so you have a lot of work @ 2old4toys I can not buy LG-SU870 because Poland is the GSM standard, and the phone supports only CDMA 800/1900. How do I fix this'm wrong
Trying really hard to understand this google translation... Anyway the thing is that for P720 there arent any ROMS and yes LG sucks at updating phones (we still dont have official ICS for P920, not that i care much about it). So once again the choice is yours..wait.. or buy something else. Unless you wanna buy me an LG P720 for christmas so i can make a few ROMS for you...
How To UnRoot - LG Optimus One - Gingerbreak
Hey everyone, A month ago today, I rooted my old LG Optimus One with the Gingerbreak APK. Is there a way to UnRoot the phone, just as easy as I rooted the phone?
Trytohaxme said: Hey everyone, A month ago today, I rooted my old LG Optimus One with the Gingerbreak APK. Is there a way to UnRoot the phone, just as easy as I rooted the phone? Click to expand... Click to collapse Search a bit before posting. I found so many threads. http://forum.xda-developers.com/showthread.php?t=1636277 http://forum.xda-developers.com/showthread.php?t=1473167 http://forum.xda-developers.com/showthread.php?t=1243522 http://forum.xda-developers.com/showthread.php?t=1085147 . My personal opinion is to use SuperOne Click rather than going for KDZ updater. As using KDZ updater can also brick your phone if you remove your battery in emegency mode.
[Q] Install rom P500 for KU3700 ?
I have 1 LG KU3700 portable equipment from South Korea, is the original LG Optimus One P500. Question, can I install rom of P500 and KU3700 not it?
Help me
what? can you clarify ur question... specifically...
voltaire23 said: what? can you clarify ur question... specifically... Click to expand... Click to collapse He's specifically saying that can he install P500 ROMs on his Korean Optimus One @ the op I am not sure but there were indeed some users of KU3700/SU3700 Sent from my GT-I9082 using Tapatalk
@akiratoriyama @rylryl79 Yeah, I looked around XDA and while there are some users of the Korean Optimus One, the impression I'm getting is that stuff made for the P500 is not compatible with the Korean Optimus One versions. Even trying a P500-based recovery will brick your phone (or get you stuck at the LG logo). There's a custom recovery for the KU3700, but as far as I know, no custom ROM yet.