We have identified a new heap buffer overflow vulnerability in Samsung’s Android Radio Interface Layer implementation. The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve arbitrary code execution in Android in the radio context.

The vulnerability we are disclosing in this advisory affected a wide range of Samsung devices, including phones on the newest Exynos chipsets. The July 2023 issue of the Samsung Mobile Security Bulletin contains this vulnerability as CVE-2023-30649.

Vulnerability Details

The Exynos vendor RIL implementation, provided by the libsec-ril.so library, exposes an Inter Process Call (IPC) interface to the baseband processor. The baseband processor can use this API through dedicated IPC messages.

When the IpcProtocol41Sap::IpcRxPRSimApdu IPC handler is triggered it allocates a heap object and calls RmtUimNeedApdu::RmtUimNeedApdu to populate it based on the content of the IPC message.

The vulnerability is in this RmtUimNeedApdu::RmtUimNeedApdu function as it fails to verify the provided length field and overflows the allocated buffer. The length is stored on two bytes, the maximum value is 0xffff while the heap buffer size is 0x120 bytes.

RmtUimNeedApdu * __thiscall
IpcProtocol41Sap::IpcRxPRSimApdu
          (IpcProtocol41Sap *this,sipc_ipc_msg *param_1,int param_2,int *param_3,
          RegistrantType *param_4)

{
  RmtUimNeedApdu *this_00;
  
  this_00 = (RmtUimNeedApdu *)operator.new(0x120);
  // [1] The length field is retrieved from the IPC packet without verification
  RmtUimNeedApdu::RmtUimNeedApdu
            (this_00,*(int *)(this + 0x70) + 1,0,(uint)*(ushort *)(param_1->data + 1),
             (char *)(param_1->data + 3));
  *param_4 = 0x8e;
  return this_00;
}

void __thiscall
RmtUimNeedApdu::RmtUimNeedApdu
          (RmtUimNeedApdu *this,int param_1,int param_2,int param_3,char *param_4)

{
  undefined *puVar1;
  // [2] The length field is retrieved from the IPC packet without verification
  memcpy(this + 0x18,param_4,(long)param_3);
  return;
}

The IpcProtocol41Sap::IpcRxPRSimApdu function allocates the heap object at [1] and passes the length and data fields from the IPC message to the RmtUimNeedApdu::RmtUimNeedApdu to populate the object. This function simply copies the data bytes into the heap object, using the provided size without further verification at [2].

The baseband firmware has dedicated API functions for sending and receiving IPC messages. These functions serialize the IPC content into the dedicated shared memory ring-buffers and signal the kernel through an interrupt. On the AP processor side the CPIF Android kernel driver retrieves the IPC message content from the shared memory and exposes it to the user-space through the /dev/umts_ipc0 and/or /dev/umts_ipc1 character devices.

Within the vendor rild implementation (libsec-ril.so) there are dedicated threads for continuously polling these devices. The entry point of the threads is IoChannelReader::Run and they block on the device read in the IoChannel::Read function. Once an IPC message is read from the character device it is passed to IpcModem::ReceiveMessage and subsequently to the IpcModem::DoIoChannelRouting and IpcModem::DoIoChannelRoutingRx functions. The IpcModem::DoIoChannelRoutingRx function receives the pointer to the appropriate IoChannel object where the IPC message was retrieved.

IPC messages are passed to IpcModem::GetIpcMessage and then forwarded to IpcModem::ProcessSingleIpcMessageReceived where the appropriate IpcProtocol41* implementation is retrieved based on the IPC command value. Finally, the IpcProtocol41*::GetRxData function is called which is responsible for calling the requested IPC API endpoint, based on the subcommand of the IPC message.

Affected Devices

All Samsung chipsets containing Samsung’s baseband implementation, including all Exynos chipsets.

Fix

Samsung OTA images, released after July 2023, contain the fix for the vulnerability.

Timeline

2023.04.01. Bug reported to Samsung PSIRT
2023.05.12. Samsung confirms vulnerability
2023.06.26. Samsung confirms fix will be released in the July security bulletin
2023.07.11. Samsung releases security bulletin
2023.09.26. TASZK informs Samsung of disclosure plan, Samsung confirms
2023.11.03. Vulnerability released at Hardwear.io
2023.11.26. Advisory release

CVE-2023-30649: Samsung RIL Heap Buffer Overflow

Vulnerability Details

Affected Devices

Fix

Timeline