Forest Global Training Partners

Cyber Risks · Cisco Talos

An Azure Sphere kernel exploit — or how I learned to stop worrying and love the IoT

Summary: Cisco Talos researchers Claudio Bozzato and Lilith documented a full Azure Sphere kernel exploit chain built on the pwm_ioctl_apply_state bug, fixed in version 21.03, which allowed a kfree() call on an address of their choosing. They used it to free the azure_sphere_task_cred heap object, pairing the brute-force free with a 32-bit ARM Linux kernel leak via /proc/self/syscall to reach roughly 97 percent exploit stability, then overwrote the LSM entry for prctl to run arbitrary code in the kernel.

Key Takeaway: The chain needed 8 to 10 hours of runtime, thousands of reboots and a network-connected power outlet to reset the device, and it still landed at about 97 percent stability - a reminder that a bug Microsoft initially declined to fix because KASLR was off on the device became a usable path to full kernel code execution.

Read the original at Cisco Talos ↗

Topics
Malware
Related