Kernel vulnerabilities in Android devices using Qualcomm chips explored

guest · Apr 16, 2020

Kernel vulnerabilities in Android devices using Qualcomm chips explored
April 16, 2020
https://www.zdnet.com/article/techn...ndroid-devices-using-qualcomm-chips-revealed/

A detailed analysis of two critical vulnerabilities impacting Android devices powered by Qualcomm chips has been published.

The two security flaws, tracked as CVE-2019-14040 and CVE-2019-14041, affected all Android devices with Qualcomm chipsets and could be exploited to give a malicious application full root capabilities.
Zimperium's zLabs research team originally reported the security issues to Qualcomm on July 31, 2019.
After vendors were given enough time to deploy the security fix to customers, a February security bulletin was published by Qualcomm.

Now fixes have been made readily available, Zimperium has released PoC code to GitHub (1, 2) and has given us an insight into the kernel vulnerabilities.
Click to expand...

In the Android environment, a driver exists called QTI Secure Execution Environment Communicator (QSEECOM), which manages processes that need to communicate with the TrustZone.

The first vulnerability, CVE-2019-14041, is a race condition problem steeming from a buffer update function that is sent to the TrustZone with pointers.
The second vulnerability, CVE-2019-14040, is a use-after-free flaw in kernel memory mapping.

"These vulnerabilities could allow an attacker to reach full root/kernel privileges," zLabs says. "Especially the use after free, as that one is way more reliable than the race condition. In theory, it could be possible for a completely unprivileged attacker to create a chain out of these vulnerabilities in order to achieve complete root privileges."
Click to expand...

Zimperium: Multiple Kernel Vulnerabilities Affecting All Qualcomm Devices

Takeaways
These vulnerabilities could allow an attacker to reach full root/kernel privileges. Especially the use after free, as that one is way more reliable than the race condition. As was mentioned in the intro, this blog post is essentially a continuation of a previous set of blog posts describing vulnerabilities in privileged Android services. In theory, it could be possible for a completely unprivileged attacker to create a chain out of these vulnerabilities in order to achieve complete root privileges.
Click to expand...

Surt · Aug 8, 2020

Exploring still are they, Padawan...

400+ Qualcomm Chip Vulnerabilities Threaten Millions of Android Phones
https://www.darkreading.com/vulnera...ten-millions-of-android-phones/d/d-id/1338613

Pwn2Own Qualcomm compute DSP for fun and profit
https://www.defcon.org/html/defcon-safemode/dc-safemode-speakers.html#Makkaveev

Log in or Sign up

Kernel vulnerabilities in Android devices using Qualcomm chips explored

guest Guest

Surt Registered Member

Log in or Sign up

Kernel vulnerabilities in Android devices using Qualcomm chips explored

guest Guest

Surt Registered Member

Useful Searches