Attacking the Samsung Galaxy A* Boot Chain

Quarkslab's recent research has uncovered multiple vulnerabilities in the boot chain of several Samsung devices, particularly the Galaxy A225F. These vulnerabilities allow for code execution in the bootloader, root access on Android with persistence, and the potential to leak sensitive information from the Secure World, including Android Keystore keys. The vulnerabilities identified include a heap overflow in the Little Kernel, which can be exploited to execute code persistently, and an authentication bypass in the Odin recovery system that allows unauthorized flashing of partitions. Additionally, two vulnerabilities in the Secure Monitor enable the reading of out-of-bounds memory and mapping of arbitrary physical memory, facilitating the extraction of sensitive data. The research was presented at BlackHat USA 2024, and proof-of-concept exploits for these vulnerabilities have been made available on GitHub. The findings indicate that many Samsung devices using Mediatek SoCs may be affected by these vulnerabilities, highlighting significant security concerns for users.

- Quarkslab discovered vulnerabilities in Samsung Galaxy A devices, allowing code execution and root access.

- The vulnerabilities include a heap overflow and an authentication bypass in the Little Kernel.

- Exploits can leak sensitive data from the Secure World, including Android Keystore keys.

- The research was presented at BlackHat USA 2024, with proof-of-concept code available on GitHub.

- Many Samsung devices with Mediatek SoCs may be vulnerable to these issues.