Android Parcels: The Bad, the Good and the Better - Introducing Android's Safer Parcel
summary
Explains concrete Parcel exploits and fixes: reproduces Bundle Feng Shui self‑changing bundles that enable TOCTOU attacks, and the Android 12 chain that yields arbitrary code execution via CVE-2021-0928 by causing a deserialization exception to shift offsets into activityInfo. Demonstrates a working PoC that triggers ClassNotFound/PackageManager exceptions inside nested ClipData, and describes mitigations implemented in Android 13: lazy bundle length prefixes, new type-checked parcel APIs, enforceNoDataAvail, and automated migration of ~700 call sites.
AI-written summary · about
chapters (10)
- 0:00Android Parcels vulnerabilities
- 1:28Android Parcels risks
- 3:16Parcel read-write mismatches
- 4:19Self-changing bundle technique
- 8:35TOCTOU attacks with bundles
- 10:20Mitigating parcel mismatches in Android 13
- 16:58Android VRP insights
- 23:38Exploit chain for arbitrary code execution
- 33:14Security hardening in Android 13
- 37:54Android VRP process
related talks
35mHey, Your Parcel Looks Bad - Fuzzing and Exploiting Parcel -Ization Vulnerabilties in Android
29mSecuring Android Applications - The not so se…
29mMy Other ClassLoader is Your ClassLoader Reloaded: Reviving Parcelable Objects
40mWhat ~new~ strange things one can find in AndroidX package.
34mSecuring Android: Tackling Advanced Threats and Enhancing App Security
37mPack your Android: Everything you need to know about Android Boxing
29mSecuring Android: Tackling Advanced Threats and Enhancing App Security
43mSecurity in Android Applications