We have identified a new heap buffer overflow vulnerability in Samsung’s Android Radio Interface Layer implementation. The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve arbitrary code execution in Android in the radio context.

The vulnerability we are disclosing in this advisory affected a wide range of Samsung devices, including phones on the newest Exynos chipsets. The July 2023 issue of the Samsung Mobile Security Bulletin contains this vulnerability as CVE-2023-30647.

Vulnerability Details

The Exynos vendor RIL implementation, provided by the libsec-ril.so library, exposes an Inter Process Call (IPC) interface to the baseband processor. The baseband processor can use this API through dedicated IPC messages.

When the IpcProtocol41Pb::IpcRxUsimPhoneBookCapa IPC handler is triggered it allocates a heap object and populates it based on the content of the IPC message.

The vulnerability is in IpcProtocol41Pb::IpcRxUsimPhoneBookCapa as it fails to verify the provided length field and overflows the allocated buffer. The length is stored on a single bytes, the maximum value is 0xff while the heap buffer size is 0x1b0 bytes, however it is iterated and written by 8 byte increments, allowing a 1616 byte overflow.

UsimPbCapa *
IpcProtocol41Pb::IpcRxUsimPhoneBookCapa
          (char *param_1,sipc_ipc_msg *ipc_msg,int ipc_len,RegistrantType *param_4)

{
  
  if ((ipc_msg == (sipc_ipc_msg *)0x0) || (ipc_msg->data[0] != (Data)0x2)) {
    this = (UsimPbCapa *)0x0;
  }
  else {
    // [1] UsimPbCapa object is allocated on the heap
    this = (UsimPbCapa *)operator.new(0x1b0);
    UsimPbCapa::UsimPbCapa(this);

	// [2] Length is retrieved from the IPC message
    len_byte = ipc_msg->data[2];
    if ((ulong)(byte)len_byte != 0) {
      cnt = 0;
      pDVar2 = ipc_msg->data + 3;
      dst = (uint *)(this + 0x1c);
      do {
        cnt = cnt + 1;
        *dst = (uint)(byte)*pDVar2;
        *(ulong *)(dst + 1) =
             (ulong)CONCAT24(*(undefined2 *)(pDVar2 + 3),(uint)*(ushort *)(pDVar2 + 1));
        pDVar1 = pDVar2 + 5;
        pDVar2 = pDVar2 + 7;
        dst[3] = (uint)*(ushort *)pDVar1;
        dst = dst + 8;
      // [3] Length is used as a copy loop condition, without further verification
      } while (cnt < (byte)len_byte);
    }
  }
  return this;
}

The function allocates the heap object at [1] then reads the length field at [2] and uses it at [3] to carry out the copy without further checks.

The baseband firmware has dedicated API functions for sending and receiving IPC messages. These functions serialize the IPC content into the dedicated shared memory ring-buffers and signal the kernel through an interrupt. On the AP processor side the CPIF Android kernel driver retrieves the IPC message content from the shared memory and exposes it to the user-space through the /dev/umts_ipc0 and/or /dev/umts_ipc1 character devices.

Within the vendor rild implementation (libsec-ril.so) there are dedicated threads for continuously polling these devices. The entry point of the threads is IoChannelReader::Run and they block on the device read in the IoChannel::Read function. Once an IPC message is read from the character device it is passed to IpcModem::ReceiveMessage and subsequently to the IpcModem::DoIoChannelRouting and IpcModem::DoIoChannelRoutingRx functions. The IpcModem::DoIoChannelRoutingRx function receives the pointer to the appropriate IoChannel object where the IPC message was retrieved.

IPC messages are passed to IpcModem::GetIpcMessage and then forwarded to IpcModem::ProcessSingleIpcMessageReceived where the appropriate IpcProtocol41* implementation is retrieved based on the IPC command value. Finally, the IpcProtocol41*::GetRxData function is called which is responsible for calling the requested IPC API endpoint, based on the subcommand of the IPC message.

Affected Devices

All Samsung chipsets containing Samsung’s baseband implementation, including all Exynos chipsets.

Fix

Samsung OTA images, released after July 2023, contain the fix for the vulnerability.

Timeline

• 2023.04.01. Bug reported to Samsung PSIRT
• 2023.05.12. Samsung confirms vulnerability
• 2023.06.26. Samsung confirms fix will be released in the July security bulletin
• 2023.07.11. Samsung releases security bulletin
• 2023.09.26. TASZK informs Samsung of disclosure plan, Samsung confirms
• 2023.11.03. Vulnerability released at Hardwear.io
• 2023.11.26. Advisory release