Abstract

This talk points out three attack methods that are still effective in the Android kernel: the ret2dir, the KSMA (Kernel Space Mirror Attack) and the SMA (SLAB Mirror Attack). The SMA can covert some UAF vulnerabilities into information disclosure or arbitrary writing. This meets the requirements of the KSMA. In order to demonstrate the power of this attack combination, I take the CVE-2020-3680 as an example to explain how to complete the exploitation. Finally, I analyze the corresponding mitigations. Unfortunately, some of them have not yet been enabled. I hope manufacturers can enable these mitigations as soon as possible to effectively protect user devices.