pwn2own qualcomm cdsp con 28/def con safe mode presentati… · qdi api qdi handle method number 0...
TRANSCRIPT
![Page 1: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/1.jpg)
Pwn2Own Qualcomm cDSP
Slava Makkaveev
![Page 2: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/2.jpg)
What processors are on your mobile phone?
modem DSP (mDSP/baseband)
audio DSP (aDSP)
compute DSP (cDSP)
sensor DSP (sDSP)
Kryo CPU (Android)
Adreno GPU
Wireless modem
Hexagon DSP
Spectra ISP
Snapdragon SoC
![Page 3: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/3.jpg)
DSP assignment● Low-power processing of audio and voice data● Computer vision tasks● Machine learning-related calculations● Camera streaming● Artificial intelligence● ...
Snapdragon 855 (SM8150):- Google Pixel 4- Samsung S10- Xiaomi Mi9
Snapdragon 835 (MSM8998):- Samsung S8- OnePlus 5- Sony Xperia XZ Premium
aDSP is responsible for everything Tasks are distributed between aDSP and cDSP
![Page 4: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/4.jpg)
Communication between the CPU and DSP
![Page 5: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/5.jpg)
FastRPC mechanism (AP side)
Android application
libXXX_stub.so→ libadsprpc.so→ libcdsprpc.so
/dev/adsprpc-smd/dev/cdsprpc-smd
ioctl
![Page 6: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/6.jpg)
FastRPC mechanism (DSP side)
fastrpc_shell_0fastrpc_shell_3 libXXX_skel.so libXXX.so
![Page 7: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/7.jpg)
Who can run their own code on DSP?
● DSP is licensed for programming by OEMs○ The code running on the DSP is signed by Qualcomm
● Android app has no permissions to execute its own code on the DSP○ Only prebuilt DSP libraries could be freely invoked
● Hexagon SDK is publically available● Stub and skel code will be generated automatically
Can I compile my own DSP library? Yes
Can I execute this library on DSP? No
![Page 8: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/8.jpg)
Who manages the DSP?
● ELF 32-bit executable, Qualcomm DSP6
User PD
Unsigned PD
Guest OS PD
Kernel PD
QuRT OS
/vendor/firmware/adsp/vendor/firmware/cdsp
/dsp/*/vendor/dsp/*/vendor/lib/rfsa/adsp/*
● Fastrpc shell ELFs● Dozens of skeleton and object libraries
![Page 9: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/9.jpg)
Skipping stub code from the FastRPC flow
int remote_handle_open(const char* name, remote_handle *ph
)
int remote_handle_invoke(remote_handle h, uint32_t scalars, remote_arg *pra
)
![Page 10: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/10.jpg)
We cannot sign a skeleton library, but we can execute a signed one
Android application can bring any signed skeleton library and run it on the DSP
Downgrade vulnerability CVE-2020-11209
There is no version check of loading skeleton libraries
There are no lists of skeleton libraries permitted for the device
It is possible to run a very old skel library with a known 1-day vulnerability even if a patched library exists on the device
It is possible to run a library intended for one device on any other device
![Page 11: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/11.jpg)
Feedback-based fuzzing of Hexagon libraries
![Page 12: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/12.jpg)
Fuzzing scheme
AFLskel_loader
QEMU Hexagon (user mode)
libXXX_skel.soQuRT
(runelf.pbn)
libXXX.so
Dependencies
Fastrpc shell
![Page 13: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/13.jpg)
Input file formatmethod index #8 size of input args2 input args
size of output args
value of input args2 output args
![Page 14: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/14.jpg)
Fuzzing results> 400 proven unique crashes in dozens of skeleton libraries
○ libfastcvadsp_skel.so○ libdepthmap_skel.so○ libscveT2T_skel.so○ libscveBlobDescriptor_skel.so○ libVC1DecDsp_skel.so○ libcamera_nn_skel.so○ libscveCleverCapture_skel.so
○ libscveTextReco_skel.so○ libhexagon_nn_skel.so○ libadsp_fd_skel.so○ libqvr_adsp_driver_skel.so○ libscveFaceRecognition_skel.so○ libthread_blur_skel.so○ ...
Do you remember? The skeleton code is auto generated by the Hexagon SDK. So, we are dealing with SDK issues!
![Page 15: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/15.jpg)
Automatically Generated Code
![Page 16: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/16.jpg)
Qualcomm Interface Definition Language (IDL)● Define interfaces across memory protection and processor boundaries ● Exposes only what that object does, but not where it resides or the
programming language in which it is implemented
Hexagon SDK 3.5.1, hexagon_nn 2.10.1 library, hexagon_nn.idl
![Page 17: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/17.jpg)
Example: Marshaling an in-out bufferhexagon_nn_stub.c
split in-out buffer into one in and one out buffer
save buffer lengths as data
...
...
![Page 18: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/18.jpg)
Example: Unmarshaling an in-out bufferhexagon_nn_skel.c
signed comparison of the buffer lengths
heap overflow
...
...
![Page 19: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/19.jpg)
In addition, CVE-2020-11201, CVE-2020-11202, CVE-2020-11206, CVE-2020-11207 were assigned to issues in DSP object libraries
Hexagon SDK vulnerability CVE-2020-11208● Hexagon SDK hiddenly injects vulnerabilities in the DSP libraries provided
by Qualcomm, OEM and third-party vendors
Qualcomm closed ~400 reported issues with one CVE-2020-11208 patch.Did you use Hexagon SDK? Recompile your code!
● Dozens of DSP libraries embedded in Samsung, Pixel, LG, Xiaomi, OnePlus, HTC, Sony and other devices are vulnerable due to issues in Hexagon SDK
![Page 20: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/20.jpg)
Exploiting a DSP vulnerability
![Page 21: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/21.jpg)
Let’s execute unsigned code on DSPlibfastcvadsp_skel.so library, version 1.7.1 from Sony Xperia XZ Premium (G8142) device
![Page 22: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/22.jpg)
Arbitrary read-write in User PDmethod #3F who many half-words to read (the size)
what to read (the source): the offset from the start of the first output argument in the DSP heap
where to read (the destination)
![Page 23: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/23.jpg)
Impact on device security
● Persistent DoS. Trigger a DSP kernel panic and reboot the mobile device
The next step is to gain privileges of the Guest OS PD!
Android application gains DSP User PD possibilities:
● Hide malicious code. Antiviruses do not scan the Hexagon instruction set
● The DSP is responsible for preprocessing streaming video from camera sensors. An attacker can take over this flow...
![Page 24: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/24.jpg)
QuRT drivers
![Page 25: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/25.jpg)
QuRT Driver Invocation (QDI) model
QuRT contains dozens of QDI drivers:
User PD
Guest OS PD
QDI drivers
libXXX_skel.so QuRT QDI driver
syscall
fastrpc_shell_X→ libqurt.a
/dev/*/qdi/*/power/*
/drv/*/adsp/*/qos/*
...
![Page 26: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/26.jpg)
QDI API
QDI handle
method number
0 to 9 optional 32-bit arguments
driver name
![Page 27: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/27.jpg)
QDI feedback-based fuzzing
AFLqdi_exec
QEMU Hexagon (user mode)
QuRT(runelf.pbn)
malloc + memcpypatch
QuRT segments(real device)
![Page 28: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/28.jpg)
QDI vulnerabilitiesA dozen Snapdragon 855 QDI drivers are vulnerable for PE and DoS attacks
Any failure in QDI drivers can be used to cause the DSP kernel panic
We exploited ○ several arbitrary kernel read and write vulnerabilities in
/dev/i2c QDI driver○ two code execution vulnerabilities in
/dev/glink QDI driver
![Page 29: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/29.jpg)
Demo. Code execution in Guest OS PD
![Page 30: Pwn2Own Qualcomm cDSP CON 28/DEF CON Safe Mode presentati… · QDI API QDI handle method number 0 to 9 optional 32-bit arguments driver name. QDI feedback-based fuzzing AFL qdi_exec](https://reader033.vdocuments.site/reader033/viewer/2022053110/608096c8f6247861cf207e3d/html5/thumbnails/30.jpg)
Instead of a conclusionQualcomm aDSP and cDSP subsystems are very promising areas for security research
● The DSP is accessible for invocations from third-party Android applications
● The DSP processes personal information such as video and voice data that passes through the device’s sensors
● As we have proven, there are many security issues in the DSP components