Samsung Critical Security Vulnerability: 0-click RCE in All Modern Phones | Hacker News Reader

Samsung Critical Security Vulnerability: 0-click RCE in All Modern Phones

twitter.com

54 pointsrzk18 comments

> According to my analysis, custom image formats started being introduced by Samsung around Android version 4.4.4 in the second half of 2014.

This thread is from 2010 and about the qmg format being used for boot screens: https://forum.xda-developers.com/showthread.php?t=792953

It might not be network exploitable on older devices, but still troubling.

SVE-2020-16747: Memory corruption in Quram library with decoding qmg

Severity: Critical

Affected versions: O(8.X), P(9.0), Q(10.0)

Reported on: January 28, 2020

Disclosure status: Privately disclosed.

A possible memory overwrite vulnerability in Quram qmg library allows possible remote arbitrary code execution.

---

Note that this came from project zero.

I guess they got tired of finding iOS vulnerabilities and getting crap for it.

This probably explains why the monthly security patches arrived a bit early on Samsung deviced this month.

Edit: last time something this bad happened, Samsung surprised everyone by updating really old note devices. Let's see if they can repeat that.

Samsung has a pretty good track record of pushing security updates, even to old phones.

They are also pretty open about CVEs and security patches: https://security.samsungmobile.com/

I actually got a security update on my note 3 like two days ago.

That was very unexpected!

Note 3 was released in 2013, so Samsung is pushing security patches 7 years after introduction. That's better than any other company, including Apple!!

Oh great, I probably have a vulnerable tablet (SM-T719 if anyone's curious). However, it's rooted, so no firmware updates for me for years now. And stock ROMs are almost impossible to download.

Does anyone know how to get this tablet at least somehow secure?

You can see if there is an AOSP-based ROM (like LineageOS) available. In general, unless you need some Samsung-specific software, those are better anyway since they have less bloatware/spyware since they are just plain Android.

The attack is in their image processing library, the remote exploit comes from Samsung's messages app automatically processing MMS attachments. The twitter thread said that disabling MMS auto-download [or using another MMS app?] will probably fix that, but there could be other channels that cause the library to be used.

Looks like there is an unofficial LineageOS 17.1 build.

Depending on what you need the tablet to do, it may or may not suffice (looks like the main current issues are related to camera support).

https://forum.xda-developers.com/tab-s2/development/rom-line...

That subforum also has other builds of LineageOS as well as some AOSP ports and similar stuff. Definitely a bit hacky but so goes the unofficial maintenance of older mobile devices.

Why haven't all the control flow integrity based exploit mitigation solutions not gained wider adoption? They would prevent exploitation of RCE like this right?

https://en.m.wikipedia.org/wiki/Control-flow_integrity

That's what they said about of all the elements of the currently deployed tower of mitigations. It's better to replace unsafe codecs with sound implementations, we've known how to do that for a long time after all.

Where would I find out if my S6 is going to be patched for this?

Can someone post a TL;DR for those of us who can't watch video?

* What's the vulnerability?

* Has it been patched?

* How do we mitigate it?

* How to exploit it

The video lists these links (last one has a bug in the URL, corrected by me):

* https://bugs.chromium.org/p/project-zero/issues/detail?id=20...

* https://security.samsungmobile.com/securityUpdate.smsb

* https://github.com/googleprojectzero/SkCodecFuzzer

TLDR: Using a fuzzer, they found multiple RCEs in a custom image format called qmage. It can be turned into a interactionless takeover by sending crafted MMS messages to a phone. A major part of the attack was defeating ASLR. The qmage vulnerabilities have been patched by Samsung in the May update.

Android has an image processing library. Samsung added support for some weird image formats by a Korean company. That is the vulnerable code. The Samsung messages app automatically downloads MMS attachments and processes them. So send weird image format via SMS => RCE.

It has been patched in the latest update.

The Twitter thread says that disabling MMS auto download in the messaging app [or using another MMS app?] should probably fix the 0-click aspect of it, but would still leave open other channels of exploitation.

I have a Samsung phone. It doesn't seem to have an option to automatically disable MMS downloads, and last patch is from March.

I'm wondering if I'm vulnerable.

From what I understand, the basis of the exploit is from Project Zero work[1]. Forbes also has a minimal write-up that might be easier to grok[1], but it's been long enough that I imagine you've gotten additional info already...

1: https://googleprojectzero.blogspot.com/2020/04/fuzzing-image...

2: https://www.forbes.com/sites/forbes-personal-shopper/2020/05...

Reply on news.ycombinator.com