Monitoring Surveillance Vendors: A Deep Dive into In-the-Wild Android Full Chains in 2021

Overview: Christian Resell, Xingyu Jin, and Richard Shupak from Google present an in-depth analysis of in-the-wild Android exploit full chains deployed by commercial surveillance vendors in 2021. The talk highlights findings from Google TAG's monitoring of more than 30 commercial spyware brokers, exposing how vendors trade exploits and weaponize unpatched upstream kernel vulnerabilities. The authors deliver an exhaustive technical breakdown of two complete attack chains, focusing on sandbox escapes, the complex exploitation of CVE-2021-0920, and novel hypervisor bypass techniques.

Key Topics: - Commercial surveillance vendor tracking and exploit brokering - Chrome renderer sandbox escape and memory corruption in Linux epoll - Unix domain socket garbage collection race condition (CVE-2021-0920) - Samsung RKP hypervisor bypass and SELinux runtime policy patching

Technical Details: The first full chain targeted fully updated Android devices via a Chrome 0-day paired with an epoll reference-counting use-after-free (UAF) in the Linux kernel. Although patched within a week in upstream Linux, downstream Android kernel integration delays left devices vulnerable for nearly a year. The attackers employed a novel technique: after triggering the UAF on a file structure, they substituted the freed object with a memfd mapping and triggered a second free to bind the descriptor to libc.so. By faulting in memory pages, they mapped libc.so pages into a writable user mapping, overwriting system call code pointers across all processes to gain arbitrary code execution. The second chain delivered one-time target links redirecting to an exploit server that fingerprinted devices and targeted lagging Chrome-based browsers using N-day bugs, abusing WebAssembly RWX mappings to execute an ELF loader.

The core of the presentation explores CVE-2021-0920, a critical garbage collection flaw in the Linux kernel's unix domain socket implementation (scm_rights). When file descriptors are passed over unix sockets in circular dependencies, the kernel invokes a garbage collector (GC) tracking inflight and GC_candidates reference counts. While standard recvmsg calls synchronize with GC, invoking recvmsg with the MSG_PEEK flag bypassed GC synchronization. By orchestrating a race condition across three threads (one executing GC and two invoking recvmsg with MSG_PEEK), the exploit triggered a UAF on sk_buff (SKB) socket buffer structures. On older devices, the exploit modified addr_limit to achieve arbitrary read/write. On modern devices with ASLR and PAN, the exploit sprayed scm_fp_list structures, reclaimed slab pages using 80 closed file descriptors, and hijacked pipe_inode_info and uninitialized pipe_buffer structures via scm_unlink to construct an arbitrary kernel read/write primitive ("pipe primitive").

In post-exploitation on Samsung devices protected by the Real-time Kernel Protection (RKP) hypervisor, the exploit could not modify the read-only selinux_enforcing flag or invoke rkp_override_creds. Attackers circumvented this by locating kernel adrp instructions pointing to the in-memory SELinux policy, modifying the database, and forcing a reload to make SELinux effectively permissive. To achieve UID 0, the attackers injected shellcode into the trusted binary /system/bin/smdexe, which was authorized to call rkp_override_creds, and then executed /system/bin/simpleperf to launch the final spyware implant to harvest WhatsApp, Signal, and account databases.

Key Takeaways: Downstream mobile vendors and OS maintainers must drastically reduce the latency between upstream Linux kernel fixes and Android security patch releases to prevent 1-day exploits from operating as 0-days. Defense-in-depth mitigations, including hypervisor protections like Samsung RKP, require strict validation of trusted binary invocation and memory-mapped policy stores. Telemetry systems must actively monitor for anomalous socket buffer recycling, raw pipe tampering, and unauthorized modifications to in-memory security policies.

(AI summary — Gemini Flash)