How To Hack Shannon Baseband (from A Phone)
summary
Project Zero shows remote exploitation of the Samsung Shannon Exynos 5300 baseband used in Pixel 7 by combining firmware dumps, IDA analysis, a QEMU-like emulator, and live tests from rooted Samsung phones to find and chain SIP/SDP parsing overflows into heap corruptions and control flow hijacks. The team finds multiple bugs including CVE-2022-26497 and a SIP buffer overflow, builds a heap unlinking exploit that achieves heap code execution and live message tampering, and confirms fixes and carrier filtering limit reachability.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:15Baseband Hackathon
- 7:52P2P Attack Surface
- 9:28Dumping baseband
- 9:51Analysis
- 10:59Crashdumps
- 12:42Code review
- 13:40Filtering
- 18:59QEMU emulator
- 20:47CVE-2022-26497
- 22:30CVE-2022-29090 (SIP)
- 23:20Testing P2P bugs
- 24:41Exploitation
- 25:3795300 security features
- 27:15Shannon heap
- 28:55Heap 6
- 30:23First Attempt
- 33:37Overwrite
- 35:28Code exec from heap
- 36:17Shellcode
- 37:45Now what? (for real)
- 41:48Questions
related talks
44mExposing Critical Threats In Millions Of Connected Devices
40mOver the Air, Under the Radar: Attacking and Securing the Pixel Modem
43mBreaking Samsung's ARM TrustZone
20mSoK: Insecurity of Cellular Basebands
36mDancing with Exynos Coprocessor: Pwning Samsung for fun and “profit”
45mExploiting Qualcomm WLAN and Modem Over The Air
51mExploiting Hardware Glitches And Side Channels In Perfect Software
42mThe Hidden RCE Surfaces That Control the Droids