KSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
summary
Claims a practical rooting chain that affects devices shipping with Linux 3.18 by chaining a Use‑After‑Free race in notification/slab handling into a kernel address leak and then abusing ARM MMU features to access kernel virtual memory from userland. Implements ReVent UAF race to corrupt event buffers, uses pipe read threads to leak pointers, and a KSMA MMU attack that maps a kernel PGD into user space via TTBR manipulation and dirty‑COW tweaks, ultimately disabling SELinux and spawning a root shell in demos.
AI-written summary · about
chapters (12)
- 0:00Android kernel isolation bypass
- 1:06KSMA bypasses isolation
- 2:39Android privilege escalation
- 5:29Revenge vulnerability impact
- 9:00Race condition arbitrary read
- 12:16Bypassing PXN and SELinux
- 16:25ARM MMU address translation
- 20:00Modifying kernel virtual addresses
- 23:20KSMA exploitation demo
- 25:29Rooter based on Dirty Cow
- 30:57PGD manipulation steps
- 34:44Conclusion and challenges
related talks
42mD1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack
35mMake KSMA Great Again: The Art of Rooting Android Devices by GPU MMU Features
45mThe Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
43mBreaking Samsung's ARM TrustZone
35mKernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections
24mCurrent State of Exploit Mitigations in the Linux Kernel
27mBad io_uring: A New Era of Rooting for Android