Bad io_uring: A New Era of Rooting for Android
summary
Exploit traces a CVE-2022-20409 use-after-free in io_uring identity that frees an iouring_task object when copy-on-write races across threads, then reclaims that slab slot with a pipe buffer to convert the bug into an arbitrary read/write primitive. A user-mapped iov/ring page spray called 30 page spray reuses freed pages so pipe_buffer’s ops pointer leaks kernel addresses and enables privilege escalation on Google Pixel 6 and Samsung S22, with a KNOX cred-forging bypass by tampering the slab cache pointer.
AI-written summary · about
chapters (9)
- 0:00io_uring and security risks
- 5:23Exploiting io_uring bugs
- 10:46Memory corruption from invalid free
- 15:28Page spray for kernel heap
- 19:47Demo: Arbitrary read/write on Pixel 6
- 21:52Bypassing Samsung Knox protection
- 23:42Demo: Privilege escalation on S22
- 24:04Key takeaways and trends
- 25:49Q&A: Disabling io_uring
related talks
45mThe Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel
42mD1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack
35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
34mExploiting Race Conditions Using the Scheduler
50mRo(o)tten Apples: Vulnerability Heaven in the iOS Sandbox
34mExplosION: The Hidden Mines in the Android ION Driver
42mHack, Patch, Repeat: Insider Tales from Android’s...
24mCurrent State of Exploit Mitigations in the Linux Kernel