Forest Global Training Partners

Cyber Risks · Google Project Zero

MMS Exploit Part 3: Constructing the Memory Corruption Primitives

Summary: Project Zero's Mateusz Jurczyk, having fuzzed Samsung's Qmage image codec and reported crashes to Samsung on 28 January 2020, triaged the 174 heap "write" crashes down to 23 unique overwritten allocation sites and then 17 after filtering out QMv1 cases. He narrowed these to four candidate bug classes - the Bitmap pixel buffer, a temporary output buffer, an RLE decoding buffer, and a zlib decoding buffer - each offering control over allocation size and overflow data against jemalloc, which he notes stores no inline metadata between adjacent regions.

What you should know: The exploit path runs through the Samsung Messages app processing incoming bitmaps with no user interaction, so the payoff is a zero-click MMS attack on flagship devices - and Jurczyk's own assessment is that jemalloc's determinism, size classes and thread caches added up to a "net positive" for the attacker, which is why he is waiting on the hardened Scudo allocator in Android 11.

Read the original at Google Project Zero ↗

Topics
Vulnerabilities & Patching
Related