We have identified a new stack buffer overflow vulnerability in Samsung’s Android Radio Interface Layer implementation. The vulnerability can be exploited by a malicious (compromised) baseband runtime to achieve denial of service in Android in the radio context.

The vulnerability we are disclosing in this advisory affected a wide range of Samsung devices, including phones on the newest Exynos chipsets. The July 2023 issue of the Samsung Mobile Security Bulletin contains this vulnerability as CVE-2023-30644.

Vulnerability Details

The Exynos vendor RIL implementation, provided by the libsec-ril.so library, exposes an Inter Process Call (IPC) interface to the baseband processor. The baseband processor can use this API through dedicated IPC messages.

When the IpcProtocol41Sms::IpcRxIncomingMsg IPC handler is triggered it calls the CdmaSmsParser::CdmaSmsParser function to initialize and copy the IPC content into a stack allocated CdmaSmsParser object.

The vulnerability is in the CdmaSmsParser::CdmaSmsParser as it simply copies the entire IPC message into the provided stack allocated object without verifying the length. The maximum IPC message size is 0x40800 bytes while the stack buffer size is 1096 bytes.

CdmaSmsParser::CdmaSmsParser
          (CdmaSmsParser *this,CdmaSmsMessage *param_1,uchar *packet_data,int packet_len)

{
  [...]
  *(int *)(this + 0x1c) = packet_len;
  if (1 < *(int *)puVar1) {
    __android_log_buf_print(1,3,uVar2,"mBearerDataLen :  %d",*(undefined4 *)(this + 0x1c));
  }
  *(uchar **)(this + 0x438) = packet_data;

  // [1] The memcpy copies the IPC data into the stack object without a length check
  memcpy(this + 0x38,packet_data,(long)packet_len);
  *(CdmaSmsMessage **)(this + 0x30) = param_1;
  if (*(int *)(this + 0x2c) != 0) {
    DisplayDebugBearerData(this);
    return;
  }
  return;
}

As a result a malicious baseband can use this vulnerability to overwrite the content of stack variables and stack frames, including function return values.

(Sidenote: if the overflow value is large enough the DisplayDebugBearerData() call contains a further stack buffer overflow that is triggered first.)

The baseband firmware has dedicated API functions for sending and receiving IPC messages. These functions serialize the IPC content into the dedicated shared memory ring-buffers and signal the kernel through an interrupt. On the AP processor side the CPIF Android kernel driver retrieves the IPC message content from the shared memory and exposes it to the user-space through the /dev/umts_ipc0 and/or /dev/umts_ipc1 character devices.

Within the vendor rild implementation (libsec-ril.so) there are dedicated threads for continuously polling these devices. The entry point of the threads is IoChannelReader::Run and they block on the device read in the IoChannel::Read function. Once an IPC message is read from the character device it is passed to IpcModem::ReceiveMessage and subsequently to the IpcModem::DoIoChannelRouting and IpcModem::DoIoChannelRoutingRx functions. The IpcModem::DoIoChannelRoutingRx function receives the pointer to the appropriate IoChannel object where the IPC message was retrieved.

IPC messages are passed to IpcModem::GetIpcMessage and then forwarded to IpcModem::ProcessSingleIpcMessageReceived where the appropriate IpcProtocol41* implementation is retrieved based on the IPC command value. Finally, the IpcProtocol41*::GetRxData function is called which is responsible for calling the requested IPC API endpoint, based on the subcommand of the IPC message.

Affected Devices

All Samsung chipsets containing Samsung’s baseband implementation, including all Exynos chipsets.

Fix

Samsung OTA images, released after July 2023, contain the fix for the vulnerability.

Timeline

2023.04.01. Bug reported to Samsung PSIRT
2023.05.12. Samsung confirms vulnerability
2023.06.26. Samsung confirms fix will be released in the July security bulletin
2023.07.11. Samsung releases security bulletin
2023.09.26. TASZK informs Samsung of disclosure plan, Samsung confirms
2023.11.03. Vulnerability released at Hardwear.io
2023.11.26. Advisory release

CVE-2023-30644: Samsung RIL Stack Buffer Overflow

Vulnerability Details

Affected Devices

Fix

Timeline