PMDET: Automated Detection Tool of Android Parcel Mismatch

Android has designed Parcel as its high-performance serialization mechanism to pass objects across processes. For classes to be serialized by Parcel, developers must implement the methods for writing and reading the object's properties to and from a Parcel container. The inconsistency between those methods implemented by careless developers introduces Parcel Mismatch bugs, often occurring in vendor-customed classes due to lack of public scrutiny. Parcel Mismatch bugs can be abused by malicious applications to gain system privilege. However, no mature solutions exist to detect Parcel Mismatch bugs. This paper proposes PMDET, a fuzzing-based detection tool for Parcel Mismatch bugs. PMDET is capable of handling different vendors' firmware without actual devices. It loads Parcelable classes from Android firmware, emulates the Android runtime environment for Parcel to work, and monitors the serialization and deserialization procedures for mismatches. We evaluate PMDET with various Android firmware from different vendors. PMDET has identified 12 previously undisclosed mismatches, 6 of which are exploitable. Source code: https://github.com/tkmikan/pmdet.