Android KeyStore Permission Bypass
Posted by deepcore on February 7, 2018 – 12:09 pm
The keystore binder service (“android.security.IKeystoreService”) allows users to issue several commands related to key management, including adding, removing, exporting and generating cryptographic keys. The service is accessible to many SELinux contexts, including application contexts, but also unprivileged daemons such as “media.codec”. A permission bypass vulnerability exists in the KeyStore service due to getpidcon.
Post a reply
You must be logged in to post a comment.