Exploiting Qualcomm WLAN and Modem Over The Air

on YouTube ↗45m

" summary

Research demonstrates full over‑the‑air compromise of Qualcomm WLAN firmware and escalation into the modem and Linux kernel. A real-time debugger plus a Wi‑Fi packet injector is used to find and exploit a buffer overflow in the offload handler (disclosed as CVE-2019-10540), convert a constrained write into an arbitrary write via function‑oriented programming, call a mapping routine to map modem physical memory into WLAN address space, patch modem code and then flip page permissions to get RWX and write into kernel physical memory. Demo works but is fragile (roughly 90% packet instability) and the flaws are patched.

AI-written summary · about

" chapters (33)

1. 0:00Intro
2. 3:35MBA and Modem images
3. 3:54Modem Secure Boot
4. 5:08TOCTOU Vulnerability Bypass Secure Boot
5. 6:00Debug Server Injection
6. 7:23Qualcomm WLAN Architecture
7. 8:33Example - WIFI List
8. 9:40Firmware
9. 10:06Reverse Engineering - Hint From Qualcomm
10. 10:50Reverse Engineering - Offload Handlers
11. 11:36Sample Offload Handler
12. 13:08The Roadmap
13. 13:38Mitigation Table (WLAN & Modem)
14. 15:55The Vulnerability (CVE-2019-10540)
15. 17:27Data & Address of Overflow
16. 18:00Smart Pointer Around Overflow Memory
17. 18:31Usage Of Smart Pointer
18. 20:39Global Write With Constraint
19. 22:31Control PC & RO
20. 23:55Transform To Arbitrary Write
21. 25:04Run Useful FOP Gadget
22. 25:54Memory Mapping RWX
23. 27:13Copy Shellcode to 0x42420000
24. 28:18Trigger Shellcode
25. 28:56From WLAN to Modem
26. 30:26Map Modem Memory into WLAN
27. 32:32The Attack Surfaces
28. 33:14Memory Management of Qualcomm Multi-Processor
29. 35:09CVE-2019-10538
30. 37:55Deliver the Payload Over-The-Air
31. 38:31Deliver the Payloads Using Pixel2
32. 40:02Demo
33. 43:32Future Works

" related talks

• 44mExposing Critical Threats In Millions Of Connected DevicesAlexander, Sergey · Hardwear.io USA 2024
• 40mOver the Air, Under the Radar: Attacking and Securing the Pixel ModemEugene Rodionov, Xuan Xing, Xiling Gong, Farzan Karimi · Black Hat USA 2023
• 25mAttacking Mobile Broadband Modems Like a Criminal WouldAndreas Lindh · Black Hat USA 2014
• 27mWIFI-Important Remote Attack Surface: Threat is ExpandingYe Zhang, Haikuo Xie, Ying Wan · Black Hat Asia 2020
• 38mModems (and telecoms) are also not as secure - 6 0-days to 4 million modems within a weekTa-Lun Yen · CODE BLUE 2023
• 39mReflections on Trusting TrustZoneDan Rosenberg · Black Hat USA 2014
• 41mUnlock hidden Superpowers in MediaTek Wi-Fi ChipsEdoardo Mantovani, Daniel Wegemer · Nullcon Berlin 2025
• 37mVlind Glitch: Blind VCC Glitching Technique to Bypass the Secure Boot of Qualcomm MSM8916 Mobile SoCVicente Arnau, Hector Marco · Black Hat Europe 2022