Pwn2Own Qualcomm Compute DSP for Fun and Profit
Check Point researcher Slava Makkaveev audits Qualcomm Snapdragon compute DSPs (cDSP), disclosing critical vulnerabilities that allow malicious Android apps to take over the DSP.
Summary
The Role of Compute DSPs in Snapdragon SoCs
Qualcomm Snapdragon chipsets integrate specialized Compute Digital Signal Processors (cDSP) to accelerate multimedia, audio processing, and machine learning at low power.
Auditing the Proprietary FastRPC and cDSP Subsystems
Slava Makkaveev investigates the closed-source FastRPC communication interface connecting the Android kernel to the Hexagon cDSP execution environment.
Discovering Multiple Zero-Days in DSP System Libraries
Fuzzing proprietary cDSP libraries and system calls uncovered severe memory corruption flaws allowing unprivileged Android applications to execute arbitrary code in DSP firmware.
Defending Low-Level Coprocessor Boundaries
Makkaveev presents exploit mitigations and details coordinated vulnerability fixes implemented by Qualcomm to secure DSP execution domains.
Related talks
Main Stage·32 min
Xiling Gong
Achieves over-the-air code execution on Android phones by exploiting vulnerabilities in Qualcomm WLAN and modem baseband firmware.
Main Stage·41 min
Adam Donenfeld
Adam Donenfeld details multiple privilege escalation vulnerabilities and memory corruption flaws discovered across Qualcomm mobile chipset drivers.
Main Stage·42 min
Philippe Laulheret
Demonstrates the ReVault hardware attack targeting secure microcontrollers embedded across over 100 enterprise laptop models to compromise master keys.