Wideshears: Investigating and Breaking Widevine on QTEE
summary
Widevine on QTEE gets a practical break: a Widevine TA command parser accepts a subsample out-of-bounds on offset that permits precise one-byte and multi-byte memory moves from arbitrary offsets, combined with a physical-address leak via generate_signature that leaves ion physical addresses in a returned buffer. ASLR for the TA is defeated by scanning the CKFPP region for page signatures, an overlapping ion-buffer layout provides read/write primitives into TA memory, and the exploit extracts keybox data from QTEE SFS.
AI-written summary · about
chapters (10)
- 0:00Introduction and agenda
- 2:44TrustZone basics
- 4:19Command handling analysis
- 8:15First vulnerability found
- 9:34ASLR bypass and TA location
- 11:53Shared memory exploitation
- 14:47Second vulnerability found
- 17:17Memory layout strategies
- 21:51Data exfiltration attack
- 24:39Conclusion and Q&A
related talks
50mForking QEMU to emulate and secure the Tillitis TKey
27mTranslation Leak-aside Buffer: Defeating Cache Side-channel Protections
44mKernel TEE subsystem BoF
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
51mExploiting Hardware Glitches And Side Channels In Perfect Software
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
53mUnderstanding TOCTTOU in the Windows Kernel Font Scaler Engine
13mSecurity Theater: Moving Beyond Performative Content Protection