The Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel
summary
Discloses two Android kernel UAFs with concrete exploitation steps: CVE-2017-0403 uses iovec/readv–writev and the pipe subsystem to convert a 16‑byte overwrite of a freed perf_event structure into arbitrary kernel memory writes, forming a universal root exploit that rooted ~14 million devices; CVE-2016-6787 is a race in perf move_group where context refcount drops to zero, and the exploit freezes attacker threads with futex wait queue tricks to prevent scheduler crashes long enough to spray the heap and reuse objects.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:33About me
- 2:14Team
- 3:00Agenda
- 3:26Current Situation
- 4:22SELinux
- 5:39Verification
- 6:31Future Challenges
- 7:55Overview
- 8:17Explanation
- 14:34Cisco Perf Events
- 17:06Move Group
- 19:23First Problem
- 20:10Solution
- 22:38Exploitation
- 24:55Summary
- 25:47Implementation
- 27:11Scenario
- 31:41Read Read Vector
- 33:04Copy Buffer to User
- 35:38Summary of Exploit
- 36:25Conclusion
- 37:49Demo
- 42:17Mobile Devices
related talks
27mBad io_uring: A New Era of Rooting for Android
35mKSMA: Breaking Android Kernel Isolation and Rooting with ARM MMU Features
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
42mD1T2 - Rooting Android 8 with a Kernel Space Mirroring Attack
36mUnderstanding & explaining Use-After-Free vulnerability, a critical security flaw
34mExploiting Race Conditions Using the Scheduler
42mAndroid: Protecting the Kernel
43mUnix Domain Socket: A Hidden Door Leading to Privilege Escalation in the Android Ecosystem