Abstract

Last year, Google Project Zero disclosed a UAF bug in Android binder, which exploited in the wild. Although the whitepaper and Proof-Of-Concept code are available, it's far from enough to build a universal full-chain exploit. To recover the attack, there are two critical problems that must be solved. The first one is how to attack the 64-bit kernel in the 32-bit process. The apps published on Google Play have been enforced to support 64-bit architecture. However, Chrome app still ran in 32-bit mode at that time. And according to the design of Linux on ARM 64-bit Architecture, AArch32/AArch64 cannot interwork. The second one is how to build the kernel exploit for various kernel branches under the chrome sandbox circumstance, and satisfy the marketed capability - "The exploit requires little or no per-device customization".

In this talk, we will detail two totally different exploitation views to recover the attack. The first one is how to build the 64-bit exploit in the 32-bit sandboxed process. We will introduce a new exploitation technique, named Arch-flip. It derives from the classic features of Linux kernel, which we used to bypass one part of the Real-time Kernel Protection of Samsung's mobile kernel several years ago. With this technique, an attacker can execute 64-bit assembly instructions and make 64-bit syscalls in the 32-bit process and vice versa, breaking the abovementioned kernel restriction. We will detail how to use it in the sandboxed process and make the 64-bit exploit work in the 32-bit process smoothly. The second one is building the 32-bit exploit.

Under the sandbox circumstance, only a few syscalls are available, and some implementation of syscalls and kernel objects' structure can alter in different kernel branches, it's quite challenging to build the universal kernel exploit. Additionally, we still have to bypass the common(PXN/PAN/KASLR/CFI) and vendors' mitigations. We will discuss our tries and the final implementation of the full-chain exploit.

• During the presentation, we will give the full-chain exploit demos of different vendors' devices. And the videos were public last year. In summary, the ideas of exploitation are fresh and have never been discussed before.