D1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack
summary
Details an out‑of‑bounds write in the media codec that writes 0x80-bytes into process memory when decoding a crafted 0x80-filled mp4, uses shared memory padding to bypass ASLR, escapes the mediacodec SECCOMP sandbox and gains control of one mediaserver thread with ~100% reliability. Describes a kernel rooting chain ReVent that turns a TOCTOU UAF (affects kernels ≥3.18) into stable arbitrary kernel writes via the pipe subsystem, and a new Kernel Space Mirroring Attack that abuses ARM translation descriptors to r/w kernel virtual addresses from user mode, bypassing PXN and PAN on Android 8.0; demos show full root on Oreo devices.
AI-written summary · about
chapters (8)
- 0:00Introduction and motivation
- 1:26Android 8 security challenges
- 5:29Kernel space mirroring attack overview
- 13:42Exploiting codec vulnerabilities
- 24:47Bypassing Android 8 mitigations
- 28:25Color space mirroring technique
- 37:23Root shell via SMA
- 40:08Demo and conclusion
related talks
35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
45mThe Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel
36mPhysical Attacks Against Smartphones
35mKernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections
15mExploiting Android Apps with Counterfeit Art
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
27mBad io_uring: A New Era of Rooting for Android
42mThe Hidden RCE Surfaces That Control the Droids