Elevating The TrustZone To Achieve A Powerful Android Kernel Exploit | Tamir Zahavi Nullcon Goa 2022

Abstract :
----------------
In today's mobile security world, where attack surfaces are constantly being tightened and new mitigations keep being introduced, kernel exploits are a highly complex matter. This imposes multiple obstacles for anyone looking to develop such exploits. First, reliability is an issue. The involvement of many moving parts (e.g. race conditions, heap grooming) makes reliably exploiting the kernel a very hard task. Second, even once you manage to build a successful exploit, there is then the cumbersome process of carefully adapting it for each device/version you wish to run it on.
In this talk, I will present a different approach to Android kernel exploitation, intended to overcome the obstacles mentioned above. I will describe a vulnerability I found in the Android kernel (CVE-2021-1961), and the interesting way I exploited it.
My exploitation method revolves around utilizing an even higher privileged component, the TrustZone. By doing this, I managed to overcome all existing security mitigations in the Android kernel, creating a 100% reliable exploit. Not only that, but the exploit is powerful enough to work on all combinations of devices/versions without requiring any code adaptation. In the talk, I will discuss what makes this exploitation technique so powerful, how come it bypasses existing mitigations so easily, and why it should probably even bypass future expected mitigations.
Besides the exploit itself, I will go into detail about the communication protocol between the kernel and the Qualcomm TrustZone (AKA QSEE), and where its weaknesses lie. Additionally, I will explain how you can start your own research in this area.
#Android #kernel #infosec #NullconGoa2022 #Nullcon
--------------------------------------------------------------------------
Follow nullcon on Facebook: / nullcon
Twitter: / nullcon
LinkedIn: / nullcon
Website: nullcon.net