Core Escalation: Unleashing the Power of Cross-Core Attacks on Heterogeneous System
No ratings
Presented at BlackHat USA 2023 by
As features of smartphones continue to advance, their SoCs become increasingly complex. In addition to the Application Processor (AP), the SoC also runs other cores such as baseband, camera, sensor hub and low power management module. As a result, permission control and security boundary management cannot only apply to a single processor, but require thoughtful consideration of all running processors. Exception level (EL) based solutions (e.g., ARM Trustzone) on a single processor are facing more and more threats from other cores. Any attack from a core with inadequate defenses could compromise the entire SoC. In fact, there have been many real world examples demonstrating the cross-core attacks on mobile devices, such as compromising the AP from WiFi and baseband via DMA.This talk will systematically explore the emerging privilege escalation methodology empowered by co-processors in a heterogeneous structure. Specifically, we will first introduce various cross-core communication implementations, and analyze the security challenges and new attack surfaces. We will then share how we found various novel logical vulnerabilities in such attack surfaces of a popular brand of smartphone. Finally, we will explain in detail how to exploit these vulnerabilities by means of cross-core communication to achieve privilege escalation, including two detailed case studies that demonstrate how the camera and sensor hub can attack the AP to gain full EL3 privilege, bringing a new perspective for future multi-core security design and exploit development.