Dancing with Exynos Coprocessor: Pwning Samsung for fun and “profit”
summary
Finds 13 Exynos MPU/NPU bugs in Samsung phones (double frees, out‑of‑bounds reads/writes, arbitrary free) including CVE-2025-23095, CVE-2025-23097, CVE-2025-23099 and CVE-2025-23101, some limited to Exynos 1380 and others affecting 1480/2400. Exploits spray kernel objects (socket buffers or page tables), reclaim freed objects as pipe or AIO buffers, leak kernel addresses to bypass KASLR and overwrite init to get root, and disable SELinux. Patches land June 2024; mitigation via MT is effective but not broadly deployed.
AI-written summary · about
chapters (20)
- 0:00Samsung Exynos MPU research intro
- 1:08Research background and bugs
- 3:22Focus on Exynos MPU
- 4:49IO control and session handling
- 6:20Double free in prepare imb info
- 7:02Out of bounds in NPU profile
- 8:13Double free in DMA buffer
- 9:17Out of bounds in NPU Q alloc
- 10:26MPU fence session flaws
- 11:50MPU watchdog timer bug
- 12:32Arbitrary kernel free in WS4L
- 14:40Double free in webq stop
- 15:21Out of bounds in MPU update
- 16:24Out of bounds in VS4L buffer
- 17:51Bug impact across Exynos
- 18:34Arbitrary free in WS4L exploit
- 22:29Out of bounds in NPU Q exploit
- 30:49Summary of findings
- 31:09Bug reporting timeline
- 32:33Q&A
related talks
37mAttacking NPUs of Multiple Platforms
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
45mThe Art of Exploiting Unconventional Use-after-free Bugs in Android Kernel
43mBreaking Samsung's ARM TrustZone
42mThe Hidden RCE Surfaces That Control the Droids
51mExploiting Hardware Glitches And Side Channels In Perfect Software
42mHow To Hack Shannon Baseband (from A Phone)
36mPhysical Attacks Against Smartphones