full-disclosure - [FD] Aleph Research: Attacking Nexus 9 with Malicious Headphones (CVE-2017-0510)

Open Source and information security mailing list archives

Message-ID: <HK2PR04MB11387FF30385CF157DDC641691220@HK2PR04MB1138.apcprd04.prod.outlook.com>
Date: Sun, 12 Mar 2017 09:36:06 +0000
From: Roee Hay <roee.hay@....com>
To: "bugtraq@...urityfocus.com" <bugtraq@...urityfocus.com>,
 "fulldisclosure@...lists.org" <fulldisclosure@...lists.org>
Subject: [FD] Aleph Research: Attacking Nexus 9 with Malicious Headphones
 (CVE-2017-0510)

Title:
Attacking Nexus 9 with Malicious Headphones

Identifier: 
CVE-2017-0510

Severity: 
Critical

Product:
Google Nexus 9

Vulnerable Version:
Android 7.1.1 N4F26Q and below

Mitigation: 
Upgrade to build N4F26T (March 2017 Security patches).

Technical Details:
Nexus 9 (running build N4F26Q and below) allows unauthorized access to the FIQ debugger via its headphones jack, which has the following impact:
1. It enables sensitive information theft, via malicious headphones, out of arbitrary processes. For example, by exploiting this vulnerability we managed to leak stack canaries and weaken ASLR. 
2. It allows the adversary access the Linux SysRq interface.
3. The attacker can reboot the device, via the FIQ debugger, into HBOOT, which may aid in further exploitation such as communicating with internal SoCs via I²C. 
4. The attacker can conduct a Factory Reset.

Research post with full details:
https://alephsecurity.com/2017/03/08/nexus9-fiq-debugger/

Credit:
1. Roee Hay (@roeehay), Aleph Research, HCL Technologies.
2. Sagi Kedmi (@sagikedmi)

::DISCLAIMER::
----------------------------------------------------------------------------------------------------------------------------------------------------

The contents of this e-mail and any attachment(s) are confidential and intended for the named recipient(s) only.
E-mail transmission is not guaranteed to be secure or error-free as information could be intercepted, corrupted,
lost, destroyed, arrive late or incomplete, or may contain viruses in transmission. The e mail and its contents
(with or without referred errors) shall therefore not attach any liability on the originator or HCL or its affiliates.
Views or opinions, if any, presented in this email are solely those of the author and may not necessarily reflect the
views or opinions of HCL or its affiliates. Any form of reproduction, dissemination, copying, disclosure, modification,
distribution and / or publication of this message without the prior written consent of authorized representative of
HCL is strictly prohibited. If you have received this email in error please delete it and notify the sender immediately.
Before opening any email and/or attachments, please check them for viruses and other defects.

----------------------------------------------------------------------------------------------------------------------------------------------------

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives