From Zero To Root: Attacking Qualcomm DSP Driver

From Zero To Root: Attacking Qualcomm DSP Driver

Speakers: Xiling Gong, Senior Security Researcher, Tencent Blade Team

Conference: OffensiveCon

YouTube: https://www.youtube.com/watch?v=TogmH2HEIKM

Overview

This talk by Xiling Gong from Tencent Blade Team delves into a critical vulnerability (CVE-2023-47394) found within the second generation of Qualcomm's FastRPC driver, a core component responsible for interfacing with the Audio/Application Digital Signal Processor (ADSP). The presentation meticulously details a complex, multi-stage exploit chain that leverages this vulnerability to achieve root privileges from an untrusted Android application. This research is particularly significant as it targets a highly privileged and often overlooked component of modern System-on-Chips (SoCs), demonstrating how even after substantial security improvements, complex drivers can harbor exploitable flaws.

The FastRPC driver acts as a crucial bridge, allowing user-space applications to offload computationally intensive tasks to the ADSP, a dedicated co-processor optimized for high-performance, low-power operations. While the ADSP's hardware architecture is closed-source, the FastRPC driver is open-source, making it a prime target for security researchers. Gong's work highlights the persistent challenge of securing such intricate software components within the Android ecosystem, where a single vulnerability in a privileged driver can undermine extensive platform-level security mitigations, ultimately exposing user data and system integrity.

The talk not only uncovers a severe vulnerability but also provides a masterclass in modern kernel exploitation. It showcases the ingenuity required to bypass an array of contemporary Android and Linux kernel defenses, including KASLR (Kernel Address Space Layout Randomization), KFI (Kernel Function Instrumentation), PAC (Pointer Authentication Codes), DEP (Data Execution Prevention), and SELinux. By navigating these formidable barriers, the research underscores the continuous cat-and-mouse game between attackers and defenders, emphasizing the need for deeper architectural scrutiny and more robust memory safety practices in critical device drivers.

Background

▶ Watch: Attacking Qualcomm DSP Driver: Introduction and overview (0:00)

Modern mobile SoCs, particularly those from Qualcomm, integrate specialized co-processors like the ADSP (Audio/Application Digital Signal Processor) to handle tasks requiring high performance and low power consumption, such as audio processing, computer vision, and machine learning. These DSPs run on their own distinct architectures, often Hexagon in Qualcomm's case, separate from the main ARM-based application processor. The FastRPC (Fast Remote Procedure Call) driver serves as the essential "glue" layer, enabling user-space applications running on the main Android processor to communicate with and utilize the capabilities of the ADSP.

Historically, direct attacks on kernel drivers from untrusted applications typically focused on components directly exposed to user space, such as the GPU or Binder drivers. The FastRPC driver, however, is not directly accessible to untrusted applications. Instead, it's exposed only to the ADSP service, a privileged component. A key enabler for this attack is a design choice: when an untrusted application opens a session to the ADSP service, the service subsequently opens a device node for the FastRPC driver and then returns the resulting file descriptor back to the untrusted application. This seemingly innocuous hand-off effectively grants the untrusted app control over the FastRPC driver, creating an unexpected, yet critical, attack surface.

The FastRPC driver provides three primary functionalities: managing user processes on the ADSP (allowing arbitrary code execution in ADSP user mode), managing shared memory for efficient data transfer between processors, and facilitating remote function invocation on the ADSP. The latter, remote function invocation, is designed for developer convenience, allowing user-space applications to call ADSP functions as if they were local. This convenience, however, introduces significant complexity in the underlying parameter marshaling, memory management, and data copying between user and kernel spaces, making it a ripe area for vulnerabilities.

Previous research into FastRPC drivers has identified numerous security issues. Xiling Gong himself had discovered six or seven issues in the first generation of the FastRPC driver between 2021 and 2022. However, he initially underestimated their severity, believing them inaccessible from untrusted apps. It was only after Project Zero’s research in the same area that the full exploitability of these types of vulnerabilities became apparent. In response to the high volume of issues (over 16 reported in the first generation), Qualcomm undertook a significant effort to improve the driver, leading to the development of the second generation. This new iteration primarily focused on simplifying memory management, which was the source of many previous bugs. While the second generation indeed saw a reduction in reported vulnerabilities (only 7-8 total, with 4 found by external researchers), it was still not entirely immune, as demonstrated by the discovery of CVE-2023-47394.

Key Findings

▶ Watch: Lessons from past fast RPC vulnerabilities and motivation (3:50)

The central finding of this research is the discovery and successful exploitation of CVE-2023-47394, a critical vulnerability residing within the second generation of Qualcomm's FastRPC driver. This flaw is a buffer size calculation mismatch that occurs during the complex process of copying parameters from user space to kernel space for remote function invocations on the ADSP.

Specifically, the vulnerability manifests when the driver allocates memory for ION buffers and long ION buffers—specialized memory regions used for efficient data sharing. When calculating the total buffer size required for an operation involving both an ION buffer and a potentially overlapping long ION buffer, the kernel driver mistakenly omits the size of the long ION buffer from the overall allocation. This results in an undersized memory allocation. The critical aspect is that the long ION buffer can be placed at an arbitrary offset relative to the ION buffer. By providing a negative offset, the attacker can cause the destination address for the long ION buffer’s contents to fall before the start of the legitimately allocated kernel buffer, leading to a backward out-of-bounds write.

The exploit primitive derived from CVE-2023-47394 is exceptionally powerful. The attacker gains full control over:

• Offset: The distance by which the write occurs before the allocated buffer (limited only by the size of the surrounding DMA buffer, potentially hundreds of megabytes).
• Content: The data being written.
• Length: The amount of data written.

Furthermore, the same underlying mechanism that permits an out-of-bounds write can also be leveraged to perform an out-of-bounds read by using the copy_to_user function. This combination of arbitrary backward read and write primitives provides an ideal foundation for kernel exploitation.

Despite this potent primitive, the journey from vulnerability discovery to a full root exploit was fraught with challenges due to the robust security mitigations implemented in modern Android and Linux kernels. These findings highlight:

1. Persistent Vulnerability in Complex Drivers: Even after significant refactoring and security improvements (as seen in FastRPC Gen2), the inherent complexity of driver-level memory management continues to introduce exploitable flaws.
2. Mitigation Bypass Complexity: Modern kernel mitigations like KASLR, KFI, PAC, DEP, and SELinux are highly effective, forcing attackers to develop multi-stage, sophisticated techniques involving memory layout manipulation, register hijacking, and kernel-level Return-Oriented Programming (ROP) chains to achieve privilege escalation.
3. The Role of SELinux: SELinux proved to be a critical final barrier, silently blocking the execution of user-mode helper shellcode, necessitating an additional arbitrary write primitive to disable it before the final payload could execute.

In essence, the key finding is not just the vulnerability itself, but the comprehensive demonstration of how a single, well-understood class of bug (buffer overflow) can still be leveraged to achieve full system compromise on a hardened Android device by meticulously dissecting and bypassing every layer of defense.

Technical Deep Dive

▶ Watch: Analysis of second-generation fast RPC driver improvements (5:45)

The technical deep dive into CVE-2023-47394 and its exploitation reveals a sophisticated multi-stage attack targeting the Qualcomm FastRPC driver. The vulnerability itself stems from a miscalculation in buffer allocation during remote function calls. When a user-space application invokes a remote function on the ADSP, parameters need to be copied into kernel space. This often involves ION buffers and long ION buffers. The FastRPC driver, in its second generation, contains a flaw where it allocates a buffer for the ION data but fails to correctly account for the size of the long ION buffer, especially when an offset is provided. If this offset is negative, the long ION data is copied to a memory location before the start of the allocated buffer, resulting in a backward out-of-bounds write. This primitive is powerful because the attacker controls the offset, the content, and the length of the write.

The exploit chain, designed to bypass modern kernel mitigations, proceeds through several critical stages:

1. Memory Layout Shaping and Stabilization:

• Targeting the vmalloc Area: The vulnerable buffer is a DMA buffer allocated in the vmalloc area, a region used for non-physically contiguous kernel memory. Unlike traditional heap overflows which target direct-mapped memory, this requires specific techniques.
• vmalloc Spray: To reliably place the victim kernel objects, the attacker performs a "vmalloc spray." This involves allocating numerous DMA buffers using IOCTL_DM_BUFFER to occupy the vmalloc region, effectively creating a predictable memory landscape.
• Kernel Stack Placement: The goal is to get the FastRPC vulnerable buffer allocated immediately adjacent to a kernel stack. By spraying a large number of user-space processes or threads, the attacker forces the kernel to allocate many corresponding kernel stacks. With the vmalloc area sufficiently "cleaned" and sprayed, the FastRPC buffer is deterministically placed next to one of these kernel stacks.
• Victim Thread Stabilization: Kernel stacks are highly dynamic. To create a stable target for the backward OOB write, the victim thread is put into a waiting state using IOCTL_WAIT_TIME_STUFF. This blocks the thread, fixing the contents of its kernel stack, including local variables, registers, and crucially, the return address of the waiting_event_interrupt_timeout function.

1. KASLR Defeat (Arbitrary Read Primitive):

• Leveraging the backward OOB read, the attacker first reads the address of the FastRPC buffer itself. This is achieved by offsetting the read into the same FastRPC buffer, as it contains its own address.
• Once the FastRPC buffer's address is known, the address of the preceding kernel stack can be calculated.
• By performing an OOB read into the stabilized kernel stack, the attacker can extract crucial information, including the return address from the waiting_event_interrupt_timeout function. This return address reveals the kernel code base, thereby defeating KASLR.

1. Arbitrary Write and Register Hijacking (Bypassing KFI/PAC/DEP):

• Payload Deployment: The OOB write primitive is used to place a controlled payload—a collection of fake kernel objects (e.g., fake event, fake worker)—into a known DMA buffer address previously identified during the vmalloc spray.
• Register Overwrite: On the victim thread's stabilized kernel stack, the attacker overwrites specific register values (x22 and x21) that serve as parameters for the cancel_event function. These registers are redirected to point to the attacker's fake event object within the deployed payload.
• Control Flow Redirection (KFI Bypass): When the victim thread is woken up, it executes cancel_event with the now-controlled parameters. This triggers a chain of legitimate kernel function calls: cancel_event -> signal_event -> queue_work. The queue_work function is called with a controlled event_work parameter, which points to a fake worker object crafted by the attacker.
• Initial Plan (Abandoned): The initial idea was to craft a fake task_struct and use queue_work to wake it up, modifying its UID/GID to zero. This was abandoned due to the extreme complexity and crash-proneness of correctly populating all fields of the task_struct.

1. Kernel-level ROP Chain (Bypassing KFI/PAC/DEP, leading to Arbitrary Code Execution):

• Function Signature Abuse: Instead of a fake task_struct, the attacker leverages queue_work to call other kernel functions. KFI prevents arbitrary function calls but allows calls to functions with matching signatures. By grepping the kernel source, specific functions are identified that can be chained.
• ROP Gadget Chain:
• The attacker chains calls: queue_work (with fake worker) -> hw_fence_work -> a_po_work -> queue_work_on_cpu.
• This sequence ultimately leads to a powerful gadget: call_usermode_helper_exec_work. This function is designed to execute a shell script in user space with kernel privileges, using parameters specified in a subprocess_info structure.
• Shellcode Execution Attempt: The attacker crafts a subprocess_info structure containing "/system/bin/sh" and a command to connect back to the attacker's machine.
• SELinux Blockade: Upon execution, the user-mode helper is created, but the shell command fails to execute. This is due to SELinux silently blocking the operation, acting as a crucial last line of defense.

1. Final Arbitrary Write Primitive (SELinux Bypass):

• Backtracking for a Stronger Primitive: Faced with the SELinux blockade, the attacker revisits the kernel function call chain and identifies video_copy_data_work.
• Achieving Arbitrary Read/Write: This video_copy_data_work function inherently performs a memory copy, and since all its parameters are fully controlled by the attacker, it effectively provides a full arbitrary read/write primitive in the kernel.
• SELinux Disablement: Using this arbitrary write primitive, the attacker can directly modify kernel memory to disable SELinux.
• Final Root: With SELinux disabled, the call_usermode_helper_exec_work chain is re-executed, successfully running the shell script (/system/bin/sh) with root privileges, establishing a reverse shell.

This intricate exploit demonstrates a deep understanding of kernel internals, memory management, and mitigation bypass techniques, highlighting the extreme difficulty in securing complex, privileged drivers in modern operating systems.

Demo / Proof of Concept

▶ Watch: Indirect access method for fast RPC from untrusted apps (7:20)

The talk concluded with a compelling demonstration of the exploit in action, showcasing its effectiveness on a real-world device. The target device was a OnePlus 13, powered by a Qualcomm SM8750 SoC (Snapdragon 8 Gen 2). At the time of the exploit's development in August 2023, the device was running the latest available Android security update, underscoring the exploit's ability to bypass contemporary defenses.

The demonstration began by confirming the device's specifications and the current status of SELinux, which was initially enabled. The presenter then set up a listener on their laptop, waiting for an incoming connection. After launching the exploit on the OnePlus 13, a brief waiting period of approximately 10 seconds ensued, during which the exploit meticulously executed its multi-stage process: memory layout shaping, KASLR defeat, register hijacking, kernel ROP chain, SELinux disablement via arbitrary write, and finally, the execution of the user-mode helper.

The successful culmination of the exploit was visually confirmed when the listening port on the laptop received a connection, and a shell prompt appeared. Crucially, this shell displayed a # symbol, indicating root privileges, thereby demonstrating a complete privilege escalation from an untrusted application to the highest level of system access. The entire process, from launching the exploit to gaining a root shell, was remarkably quick and deterministic, solidifying the proof of concept for this sophisticated attack.

Defensive Implications

▶ Watch: Overview of fast RPC driver's three main functions (9:00)

The detailed exploitation of CVE-2023-47394 in the Qualcomm FastRPC driver carries significant defensive implications for various stakeholders:

1. For Qualcomm and SoC Vendors:

• Deep Memory Safety Review: The vulnerability highlights that even after significant refactoring and security improvements (as seen in FastRPC Gen2), complex memory management, particularly in parameter handling and buffer sizing, remains a critical source of bugs. Continuous, rigorous static analysis, fuzzing, and potentially formal verification tools should be applied to these high-privilege drivers.
• Input Validation: The root cause of the bug lies in incorrect buffer size calculation based on user-supplied offsets. Stricter and more comprehensive input validation for all parameters passed from user space to kernel space, especially offsets and lengths, is paramount.
• Driver Architecture Review: The "file descriptor hand-off" mechanism, where privileged device nodes are passed to untrusted apps via intermediate services, creates an indirect attack surface. This design pattern should be re-evaluated for critical drivers to minimize exposure.

1. For Android and Kernel Developers:

• Strengthening Mitigations: While KASLR, KFI, PAC, DEP, and SELinux proved effective barriers, the exploit demonstrated they can be chained around. This continuous cat-and-mouse game necessitates ongoing research into more robust mitigation techniques. For instance, further hardening of the vmalloc allocator or more fine-grained KFI policies could make ROP chains more challenging.
• Review of Powerful Kernel Gadgets: Kernel functions like call_usermode_helper_exec_work and video_copy_data_work were instrumental in the exploit. These powerful functions, which can lead to arbitrary code execution or arbitrary read/write, should be scrutinized for potential abuse and have their access paths further restricted or their execution contexts more tightly controlled.
• SELinux Policy Enhancement: SELinux served as a critical last line of defense, but its eventual bypass through an arbitrary write underscores that even the most robust MAC (Mandatory Access Control) system can be defeated if a sufficiently powerful primitive is achieved. Policies should be continually refined to anticipate and mitigate such scenarios.

1. For Device Manufacturers and Users:

• Prompt Patching: The exploit targeted a device with the latest security updates at the time of its development. This emphasizes the critical importance of prompt and consistent application of security patches provided by vendors. Users should always keep their devices updated.
• Supply Chain Security: The complexity of modern SoCs and their software stacks means vulnerabilities can originate from various components. A holistic approach to supply chain security, from hardware design to driver implementation, is essential.

In summary, this research serves as a stark reminder that even with significant investment in security and multiple layers of defense, the sheer complexity of privileged kernel drivers in modern mobile platforms continues to present exploitable attack surfaces. A proactive and multi-faceted defensive strategy, focusing on both prevention (memory safety, input validation) and detection/containment (stronger mitigations, refined access controls), is crucial.

Key Takeaways

• Qualcomm FastRPC Driver Remains a High-Value Target: Despite efforts to improve security in its second generation, the FastRPC driver (CVE-2023-47394) continues to be a critical attack surface for privilege escalation on Qualcomm-powered Android devices.
• Backward Out-of-Bounds Write Primitive: The core vulnerability is a buffer size calculation error leading to a backward out-of-bounds write in the FastRPC driver's parameter handling, granting precise control over offset, content, and length.
• Multi-Stage Exploit for Modern Mitigations: Achieving root required a sophisticated, multi-stage exploit chain to bypass KASLR, KFI, PAC, DEP, and SELinux, demonstrating the current state-of-the-art in Android kernel exploitation.
• Kernel Stack Overflow in vmalloc: The exploit successfully converted the OOB write into a kernel stack overflow in the vmalloc area, a less common but effective primitive for gaining control of execution flow.
• SELinux as a Critical Last Defense: SELinux proved to be a formidable barrier, blocking the initial shellcode execution attempt, necessitating an additional arbitrary write primitive to disable it before achieving final root.
• Powerful Kernel Gadgets are Abused: The exploit leveraged powerful, legitimate kernel functions like call_usermode_helper_exec_work and video_copy_data_work within a ROP chain to achieve arbitrary code execution and read/write capabilities, highlighting the need for stricter control over such functions.

About the Speaker(s)

Xiling Gong is a Senior Security Researcher with the Tencent Blade Team. His work focuses on offensive security, particularly in the realm of kernel and driver vulnerabilities. His experience includes discovering numerous issues in critical system components. He notably identified several vulnerabilities in the first generation of Qualcomm's FastRPC driver but initially underestimated their full impact until subsequent research by Project Zero highlighted the remote exploitability of such flaws. This realization motivated his renewed focus on the FastRPC driver, leading to the discovery and comprehensive exploitation of CVE-2023-47394 in its second generation. His expertise lies in deep technical analysis and the development of sophisticated exploit chains against hardened systems.