Exynos Exploit

This is a POC for exploiting the /dev/exynos-mem vulnerability introduced in earlier samsung phones. It was done out of interest in kernel vulnerability research and as a part of a CTF challenge.

The Exploit

The vulnerability introduced in these phones is the permissions for the exynos-mem device. It allowed users both R/W, even as non-root! The exynos-mem device is a device that lets you read/write directly to the /dev/mem, meaning you can directly write to kernel code/data.

By utilizing /proc/iomem you can quickly find out which physical addresses correspond to what memory on the operating system, and even find out where the Kernel Code / Data memory is.

The exploit is doing a few things in order to achieve root from this:

1. Given that we're not root, we cannot access /proc/kallsyms, which handicaps us. Therefore, we scan the kernel memory to find the format string used in kallsyms (seq_printf(m, "%pK %c %s\n", (void *)iter->value, iter->type, iter->name);) and patch it to be %p instead of %pK in order to get the symbol addresses printed out to us as users.
2. Read /proc/kallsyms to find the address of the symbol nsown_capable, which is used for identifying whether or not a user calling setuid() has permissions to do so.
3. Use this address and overwrite the function code of nsown_capable to simply return true;, letting any user call setuid() to whatever uid he wants.
4. Call setuid(0) and system(/bin/sh).

Notes

The constants in the file might need to be changed a bit to be correct for your system; set them as needed.