Analyzing a Modern In-the-wild Android Exploit
Summary: Google's Threat Analysis Group found an in-the-wild exploit chain against Samsung Android devices in December 2022, and Project Zero's analysis details its final stage: CVE-2023-0266, a race condition in the ALSA 32-bit compatibility layer where a 2017 refactor moved lock acquisition out of snd_ctl_elem_write but only for the 64-bit ioctl path, leaving the 32-bit SNDRV_CTL_IOCTL_ELEM_WRITE32 ioctl without the lock. The chain also used CVE-2023-26083, a Mali GPU driver flaw that let unprivileged code use the tlstream tracing facility to place 16 bytes of controlled data at a known kernel address and defeat KASLR, plus n-days CVE-2022-4262, CVE-2022-3038 and CVE-2022-22706, the last patched by Arm in January 2022 but never downstreamed to Samsung devices.
Key Takeaway: The ALSA lock fix landed upstream in March 2021 but was never backported to the Android kernel because its security impact went unidentified, so a bug fixed in Linux was still exploitable in the wild nearly two years later - and Arm's January 2022 Mali patch had not reached Samsung devices when the chain was found.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-22706CVE-2022-3038CVE-2022-4262CVE-2023-0266CVE-2023-26083
- Related
- CVE-2023-26083: Arm Mali GPU Kernel Driver Information Disclosure Vulnerability Known Exploited Vulnerabilities · Apr 07, 2023CVE-2022-22706: Arm Mali GPU Kernel Driver Unspecified Vulnerability Known Exploited Vulnerabilities · Mar 30, 2023CVE-2022-3038: Google Chromium Network Service Use-After-Free Vulnerability Known Exploited Vulnerabilities · Mar 30, 2023