Lifting the (Hyper) Visor: Bypassing Samsung’s Real-Time Kernel Protection

Summary: Google Project Zero's Gal Beniamini detailed multiple vulnerabilities that let an attacker subvert each of Real-Time Kernel Protection's security mechanisms, the Samsung KNOX hypervisor introduced to guard the Android kernel's integrity at runtime. The flaws were disclosed to Samsung and fixed in the January SMR, with research conducted on a fully updated Galaxy S7 Edge (SM-G935F, Exynos chipset).
Bottom line: RKP exists as a defence-in-depth layer precisely because a kernel compromise is otherwise the last boundary before full device control, and this work defeated every one of its protections, including KASLR via a single lowercase "%pk" format specifier that skipped pointer anonymisation.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026