2

Suppose that there were a security system in an Android kernel meant to prevent exploits that have arbitrary kernel memory read/write from getting root privileges. This system,

  1. Kills a process by using force_sig() with SIGKILL if the process UID or GID is 0 and if the system decides it shouldn't be.
  2. Depends on kernel variables that are read-only after init. (on/off status)

If we assume that the system decides with complete accuracy in [1] above, and KASLR is not present on the device, what can an exploit do to counter this system and get root IDs?

What I can think of:

  1. Disabling SIGKILL temporarily:
    If SIGKILL can be disabled temporarily (or even permanently until reboot) then the system is essentially useless, but I have yet to find a way to disable SIGKILL through kernel memory write.
  2. Disabling the system by flipping the read-only bits somehow:
    This is unlikely to be possible but included for the sake of completeness.
  3. Editing the text sections of kernel memory to patch the functions:
    Also unlikely to be possible because the text section is read-only.
  • system decides - how? There clearly are some UID 0 processes that are not killed, so investigating this will help you determine how to make your software look like them. If the conclusion then is that it's not possible, you still have some ways - fork or replace code of an existing root process; use user mode helper to get the kernel to execute a new root process. – domen Nov 13 '19 at 9:57
  • @domen I dug deeper into the system and it turns out that the system kills based on PIDs. Switching the PID to 0 (swapper) made the system allow the process to have UID 0. Thank you for your idea! – Zoir Nov 14 '19 at 5:39
1

If someone encounters a system like this, I suggest to follow @damon's idea and analyze how the system decides whether a root process is illegal or not. In my case it was decided based on the PID, so using arbitrary kernel write to overwrite the process's PID made it immune to being killed by the system.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.