Exploiting Android’s Hardened Memory Allocator
summary
Scudo is the default native heap on Android since Android 11 and the paper shows two concrete exploitation techniques that trick Scudo into allocating a chunk at an attacker-chosen address, yielding arbitrary memory write. One technique (forge commit base) is fixed in newer Scudo; the other abuses large-chunk bookkeeping via a fake linked list and remains applicable. The authors backport an n-day heap overflow to Android 14 and exploit the system_server over IPC, and publish a repo with a GDB plugin and heap tooling.
AI-written summary · about
chapters (5)
- 0:00Android’s hardened allocator
- 2:22Scudo internals
- 7:38Zygote fork security
- 11:49Exploiting Scudo via heap
- 15:44Conclusion
related talks
22mDemostrating Binary Exploitation
45mThe Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel
01h 00mIntroduction to memory exploitation
53mAndroid: He protec, but he also attac
07mAndroid memory tools and best practices
27mBad io_uring: A New Era of Rooting for Android
15mExploiting Android Apps with Counterfeit Art
42mHack, Patch, Repeat: Insider Tales from Android’s...