The Way to Android Root: Exploiting Smartphone GPU
Vulnerability analysis and exploit primitives targeting mobile GPU drivers to achieve local privilege escalation and Android root.
Summary
Smartphone GPU as a High Value Attack Surface
GPU security is a vital area of mobile security highlighted both by public security research as well as by in-the-wild attacks. Due to the high complexity of the GPU software/firmware along with a widely available attack surface, issues in GPU provide strong exploitation primitives for local privilege escalation attacks by the code running in unprivileged context.
Driver Vulnerabilities and Exploitation Primitives
In this talk, we will focus our research on the Qualcomm Adreno GPU, which is a very popular GPU implementation in mobile devices. We will do a deep dive into Adreno GPU kernel module implementation focusing on the most recent GPU versions, reveal its complex and new attack surfaces, and discuss vulnerabilities we discovered in this component.
Achieving Reliable Android Kernel Root
In total we identified 9+ exploitable vulnerabilities in Adreno GPU driver leading to kernel code execution and affecting Qualcomm-based devices using the latest GPU models. We will demonstrate the exploitation of one of the race condition issues on a fully-patched widely used Android device to obtain root privileges from zero-permission application with 100% success rate.
Android kernel mitigations such as CFI and W^X create significant hurdles for exploiting vulnerabilities in kernel to achieve code execution. Also race condition usually means unstable, low success rate. We'll explain how we overcome these challenges with a novel, generic exploit method that leverages GPU features to achieve arbitrary physical memory read/write. This technique bypasses key mitigations (CFI, W^X) and has broader implications for kernel heap buffer overflows. We will cover the technical details of the exploitation, and especially the novel generic exploit method.
We will also discuss the action items that the vendors could take to minimize the impact of this exploit method, as well as general methods to improve the overall security status of the GPU.
Related talks
Main Stage·47 min
Hugo Gonzalez · Caleb Howell
Deconstructs the anti-cheat and runtime integrity mechanisms in Pokemon Go, demonstrating mobile reverse engineering and integrity bypass tradecraft.
Main Stage·47 min
Qidan He
Discloses new Intent redirection vulnerabilities in modern Android frameworks that bypass destination checks to achieve LaunchAnyWhere privilege escalation.
Main Stage·47 min
Qidan He
Demonstrates novel Intent redirection and LaunchAnyWhere privilege escalation techniques in modern Android platform frameworks.