Android Universal Root: Exploiting Mobile GPU / Command Queue Drivers

## Overview

In this presentation, Google Android Security and Privacy team members Jon Bottarini (Program Manager for the Android Partner Vulnerability Initiative / APVI), Xingyu Jin, and Richard Neal (Security Engineers on the Android Malware Research team) discuss rooting exploits on Android. They examine historical privilege-escalation vulnerabilities in driver interfaces, dissect an in-the-wild root exploit named **mtksu** (MediaTek SU), analyze its runtime mechanics and obfuscation techniques, and introduce how internal vulnerability research is coordinated and remediated across the Android ecosystem via the APVI program.

---

## Historical Context: From Framaroot to Modern Exploits

Approximately a decade prior to this talk, multiple Android drivers suffered from a class of vulnerabilities collectively known as **Framaroot**. In these flaws, bugs in drivers' `mmap` handlers allowed unprivileged user-mode applications to create read/write mappings of kernel memory, enabling straightforward privilege escalation across numerous devices.

While the ecosystem subsequently improved security posture around `mmap` handlers, modern in-the-wild rooting malware emerged targeting other driver interfaces: - **CVE-2019-2215 ("Bad Binder")**: Highlighted in a Trend Micro blog post detailing Android malware attributed to an APT group. - **MediaTek SU (`mtksu`)**: Also uncovered in Trend Micro's report, targeting MediaTek devices. Originally surfaced on the XDA Developers forums with initial support for Amazon Fire HD devices before expanding to a wide range of hardware.

---

## Technical Analysis of the `mtksu` Rooting Exploit

Unlike older commercial rooting solutions like **KingRoot**—which relied on massive hardcoded tables (one identified KingRoot binary contained configuration offsets and addresses for over 5,000 Android device and kernel combinations)—`mtksu` is designed to be dynamic and portable across fragmented Android kernels:

1. **Kernel Symbol Resolution & Dynamic Disassembly**: - Parses the kernel symbol table to resolve core function names and base addresses. - Disassembles and scans the code of specific target functions for instruction patterns that access critical kernel variables or data structures. - Extracts memory addresses and structure offsets directly from these instructions, eliminating the need to maintain static device profiles. - The exploit concludes by achieving `uid=0` and switching SELinux to `permissive` mode.

2. **Binary Obfuscation**: - Contains over 250 obfuscated strings within the executable, most of which are unused decoy strings. - Resolves target device node strings passed to the `open` system call at runtime using a modified **djb2** hash lookup mechanism.

3. **Driver Flaw & Arbitrary Kernel Read/Write**: - Inspecting the device's SELinux policy (`sepolicy`) revealed that the target device node was directly accessible to regular, unprivileged Android applications. - The driver implemented an `ioctl` interface allowing user space to pass a buffer of opcodes—specifically including `read`, `move`, and `write` operations—executed directly in kernel space. - The driver functioned as designed but lacked isolation: unprivileged applications could leverage these opcodes to gain arbitrary kernel read/write capabilities.

---

## Mitigation and Ecosystem Remediation

- **Initial Mitigation**: The immediate fix involves modifying the SELinux policy (`sepolicy`) to restrict access to the driver's device node, preventing unprivileged applications from opening the device node or issuing `ioctl` calls. When access is revoked, the exploit fails during initialization. - **Vulnerability Remediation (APVI)**: The Android Partner Vulnerability Initiative (APVI) acts as Google's coordinated disclosure and remediation vehicle to track, manage, and fix such OEM- and SoC-specific driver vulnerabilities across the partner hardware ecosystem.