Abstract

Memory Tagging Extension(MTE) has been recognized as the biggest improvement since the introduction of page protection[1]. Mark Brand from Google Project Zero shared an in-depth analysis of Memory Tagging Extension (MTE) at POC2023[2]. However, as there had been no public real-world exploit of rooting Android devices with MTE enabled at that time, it remained unclear how difficult the challenge was. Therefore, I decided to figure it out.

In this talk, I will first provide a brief introduction to the Android kernel’s MTE implementation. Then, I will analyze two bugs and discuss why MTE effectively mitigates one while failing on another. Next, I will detail how to exploit the bug that cannot be defeated by MTE and gain arbitrary kernel read/write. Last but not least, I will briefly discuss how AI can assist in discovering and exploiting such bugs and summarize the talk.

During the presentation, I will give the exploit demos of rooting the affected Android devices. In summary, the ideas of exploitation have not been thoroughly presented in any previous talks.

[1] https://www.usenix.org/publications/login/summer2019/serebryany
[2] https://powerofcommunity.net/assets/v0/poc2023/MarkBrand.pdf