Make KSMA Great Again: The Art of Rooting Android Devices by GPU MMU Features
No ratings
Presented at BlackHat USA 2023 by
With more and more hardware and software mitigations, rooting Android 13 devices now requires better bugs and more advanced exploitation techniques. Five years ago, I introduced the Kernel Space Mirroring Attack (KSMA) exploitation technique[1], which is based on the CPU MMU features. Similar to the CPU, the GPU of an Android device also contains an MMU which helps to efficiently manage and access the system memory. From an attacker's view, developing a similar exploitation technique is attractive because there are no mitigations. However, due to the lack of the GPU Architecture Reference Manual, it remains unclear whether such a possibility exists.In this talk, I will introduce the GPU version of the KSMA exploitation technique. To clearly explain the technique, I will first delve into the GPU virtual address management, detail the translation table format and cache maintenance, and give examples of address translations. Since there is no GPU Architecture Reference Manual, all the details are learned from the GPU kernel driver and blind testing. Moreover, to evaluate the effectiveness of the new exploitation technique, I will respectively analyze two vulnerabilities and detail how to exploit them. Since the set of GPU instructions is confidential and the architecture has evolved, I will detail how the OpenCL kernel function can be used to read/write the physical memory parallelly. Last but not least, I will give suggestions to defeat the exploitation technique and inspire the design of effective mitigations.During the presentation, I will give the exploit demos of rooting Android 13 flagship devices. In summary, the new and generic exploitation technique and the ideas of exploitation have not been thoroughly presented in any previous talks. [1] https://i.blackhat.com/briefings/asia/2018/asia-18-WANG-KSMA-Breaking-Android-kernel-isolation-and-Rooting-with-ARM-MMU-features.pdf