- Edited
Memory tagging crashes Microsoft's Teams app, which consequentially means there is a memory corruption occuring, as MTE doesn't report false positives. It can be reproduced every time you try to sign in to the app with a Microsoft account, and every time you open the app when already signed in. I think it's safe to say that the bug has a high occurence ratio.
This bug is not new, and has been occurring for several months. At the time I sent Microsoft a report using the feedback feature within the app. I received no response, but I am somehow suspecting – given that Microsoft likely receives thousands of feedback submissions every day – that not all feedback submitted through the app is likely to be examined by a human, and probably even less likely to be forwarded to a software developer. After having reported it several months ago I do not know if anyone at Microsoft is aware of it.
I finally attempted to write a report to the Microsoft Security Response Center today, but their form requires detailing a proof of concept and an attack scenario which, as an amateur, I do not have and cannot draft without lying.
Has anyone else reported this to Microsoft, and if so, what response – if any – did you get from them?
I'm considering calling their customer support, explain the situation, and ask them to forward the report. Although I'm not looking forward to that conversation, as I doubt that most first-line support staff will know what I am talking about.
For anyone with a technical interest, here is the backtrace produced by MTE:
type: crash
osVersion: google/shiba/shiba:14/AP2A.240905.003/2024091900:user/release-keys
uid: 1010195 (u:r:untrusted_app:s0:c195,c256,c522,c768)
cmdline: com.microsoft.teams
processUptime: 44s
signal: 11 (SIGSEGV), code 9 (SEGV_MTESERR), faultAddr d26daaa83360
threadName: Thread-50
MTE: enabled
backtrace:
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 13592cc)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc dcd864)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc e2f0a4)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc e2efb0)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc f48d24)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc ff2fb4)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc ff6700)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 91e8b0)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 91e2c4)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 914cf4)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 854024)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 853aa8)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 7fe48c)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 800de8)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 800da8)
/data/app/~~xwMqC8ghK0c-2OQLnCG14w==/com.microsoft.teams-mAA0BXYk1WFPLtr9x8UaIw==/split_config.arm64_v8a.apk!libRtmMediaManagerDyn.so (pc 13632c4)
/apex/com.android.runtime/lib64/bionic/libc.so (__pthread_start(void*)+204, pc 7969c)
/apex/com.android.runtime/lib64/bionic/libc.so (__start_thread+68, pc 6a064)