ExplosION: The Hidden Mines in the Android ION Driver
summary
Research exposes over 40 vulnerabilities in the Android ION driver (branded ExplosION) that stem from ION design and vendor changes: upstream missing patches, vendor modifications and custom heaps, and unsafe buffer-sharing that yields double‑fetch and use‑after‑free conditions. One flaw produces a working privilege escalation from any untrusted app to root, bypassing KASLR and disabling SELinux; millions of devices remain affected and several CVEs are documented, with exploits and mitigation suggestions included.
AI-written summary · about
chapters (14)
- 0:00Introduction to speaker
- 1:20Understanding Ion
- 1:53Why research Ion
- 3:59Ion usage patterns
- 5:34Research methodology
- 10:35Characteristics overview
- 12:55Core driver vulnerabilities
- 17:24Vendor-specific bugs
- 19:39Customization risks
- 21:26Modification vulnerabilities
- 25:31Buffer sharing flaws
- 27:45Exploitation outcomes
- 28:27Reflections and suggestions
- 31:57Future work
related talks
27mBad io_uring: A New Era of Rooting for Android
42mAndroid: Protecting the Kernel
53mThe Art of Defense - How Vulnerabilities Help Shape Security Features and Mitigations in Android
07m"The significance of mobile exploit applications"
44mExposing Critical Threats In Millions Of Connected Devices
45mThe Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
22mA Mirage of Safety: Bug Finding & Exploit Techniques of Top Android Vendor's Privacy Protection Apps