The ideal group of people to review this material would be Mobile Platform Security Engineers, Hardware Security Researchers, and Advanced Exploit Developers.

Abstract

This presentation details a comprehensive attack chain targeting the secure boot mechanism and Trusted Execution Environment (TEE) of Samsung Galaxy A series mobile devices utilizing Mediatek System-on-Chips (SoCs). The research exploits a series of four zero-day vulnerabilities—two in the little kernel (LK) bootloader/Odin recovery system, and two in the Secure Monitor (Arm Trusted Firmware, ATF)—to achieve persistent code execution and ultimately leak hardware-backed secrets.

The initial chain bypasses signed image authentication in the Odin protocol by leveraging weaknesses in Partition Information Table (PIT) handling, enabling the flashing of a malicious partition. This malicious image exploits a heap overflow vulnerability within an unauthenticated Samsung-implemented JPEG parser in LK, resulting in persistent Arbitrary Code Execution (ACE) in the EL1 bootloader, which survives factory reset.

The second phase leverages the newly established EL1 control to target the Secure World (EL3/TEE). Two primitives are identified in the ATF via static analysis of System Management Calls (SMCs): an arbitrary memory read and an arbitrary memory mapping function. Chaining these allows researchers to map and read sensitive TEE memory regions, demonstrating the capability to dump plaintext keys from the Keymaster Trusted Application, thereby compromising the hardware-backed keystore.

Attacking the Samsung Galaxy A Boot Chain: Vulnerability Summary

• 0:05 Introduction and Context: The research targets the widely deployed, often overlooked, Samsung Galaxy A family utilizing Mediatek SoCs. The objective is to demonstrate how to bypass secure boot and leak secrets protected by the hardware-backed keystore, starting from physical access via the USB stack.
• 2:38 Mediatek Secure Boot Overview: The boot chain progresses from BootROM to Preloader, initiating the Secure Monitor (ATF, EL3), TizenOS (TEE), and the Android bootloader, little kernel (LK, EL1). Samsung customized LK with features like the Odin recovery protocol, Knox Security Bit, and a JPEG parser.
• 6:18 Vulnerability 1: LK JPEG Heap Overflow (ACE Primitive): Analysis of the Samsung-implemented JPEG parser, used to render boot errors, reveals a critical vulnerability. The logo.bin file, located in the unauthenticated upar partition, is read into a 1 GB heap buffer (7:29). The read function ignores maximum size checks if the constraint argument is set to zero (8:29), leading to a Heap Overflow when processing oversized JPEG files.
• 8:49 Exploitation of Mini-Heap: LK uses mini-heap, which lacks modern mitigations (ASLR, Canaries), and the heap is executable (10:27). The heap overflow is converted into an arbitrary write primitive by overwriting the next and prev pointers of a subsequent free chunk in the free list (10:04, 11:12). This allows hijacking the stack return address to redirect execution to attacker-controlled shellcode placed within the malicious JPEG payload.
• 14:53 Impact of V1: This vulnerability (CVE identified) yields persistent code execution in little kernel (EL1), capable of surviving reboot and factory reset. This grants full control over the Normal World, including Android system modification.
• 15:41 Vulnerability 2: Odin Authentication Bypass (Flashing Primitive): The Odin recovery protocol requires images to be authenticated (signed). By comparing the Partition Information Table (PIT), which lists flashable partitions, against the global authentication array, a subset of partitions is found that can be flashed without signature verification (17:46).
• 20:08 Odin Exploit Strategy: The strategy chains V2 to V1 by leveraging the ability to flash unauthenticated partitions (e.g., md5_HDR, D_VEND). These partitions are repurposed to hold the malicious upar image and a crafted, fake PIT. The device's Global Partition Table (GPT) is then modified to point the system to the fake PIT, ensuring the malicious upar is loaded and executed upon boot.
• 22:10 Post-Exploitation: The LK shellcode patches Android Verified Boot (AVB) checks to allow modified Android partitions, ensuring the operating system boots normally despite being compromised.
• 25:59 Transition to Secure World: The attack pivots to the Secure World (ATF/TizenOS) to extract hardware-protected secrets. Communication relies on System Management Calls (SMCs) handled by the ATF (EL3 Monitor).
• 30:46 Vulnerability 3: ATF Arbitrary Read: Static analysis of SMC handlers identifies one where an attacker-controlled address is used without validation, yielding an arbitrary read primitive into the ATF memory space.
• 32:03 Vulnerability 4: ATF Memory Map Primitive: A separate SMC handler (potentially related to Power Management) accepts an arbitrary address and size from the non-secure side and maps that region (limited to 8MB) into the monitor's address space.
• 32:55 Chaining V3 and V4: By chaining the arbitrary map (V4) and arbitrary read (V3) primitives, researchers can map the TEE's physical memory into the ATF address space and then dump its contents.
• 35:43 Key Leakage via TEE Memory Dump: The Keymaster Trusted Application (TA) is located in a known physical memory region (TEE_Reserve). Execution is hooked at the point where a user key is loaded into plaintext for encryption. The chained ATF vulnerabilities are then used to dump the TA's memory, successfully extracting the hardware-protected key material.
• 41:02 Conclusion: The combined four vulnerabilities result in a complete security compromise of the device, from secure boot bypass to persistent kernel-level control and leakage of sensitive, TEE-protected cryptographic keys. All reported vulnerabilities have been fixed by Samsung.