Samsung Nexus/Galaxy Modem libsec-ril.so RFS Command backdoor

Summaryinfo

A vulnerability classified as very critical has been found in Samsung Nexus and Galaxy. This impacts an unknown function of the file libsec-ril.so of the component Modem. This manipulation as part of RFS Command causes backdoor. There is not any exploit available. This vulnerability is considered historic because of its background and reception. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability was found in Samsung Nexus and Galaxy (Smartphone Operating System). It has been declared as very critical. Affected by this vulnerability is some unknown processing of the file libsec-ril.so of the component Modem. The manipulation as part of a RFS Command leads to a backdoor vulnerability. The CWE definition for the vulnerability is CWE-912. The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product's users or administrators. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was released 03/12/2014 by Paul Kocialkowski as Replicant developers find and close Samsung Galaxy backdoor as not defined posting (Blog). It is possible to read the advisory at fsf.org. The vendor was not involved in the public release. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $25k-$100k at the moment (estimation calculated on 03/31/2019). The attack technique deployed by this issue is T1588.001 according to MITRE ATT&CK. Due to its background and reception, this vulnerability has a historic impact. The advisory points out:

While working on Replicant, a fully free/libre version of Android, we discovered that the proprietary program running on the applications processor in charge of handling the communication protocol with the modem actually implements a backdoor that lets the modem perform remote file I/O operations on the file system. This program is shipped with the Samsung Galaxy devices and makes it possible for the modem to read, write, and delete files on the phone's storage.

We expect the 0-day to have been worth approximately $100k and more.

Applying the patch 0001-modem_if-Inject-and-intercept-RFS-I-O-messages-to-pe.patch is able to eliminate this problem. The bugfix is ready for download at redmine.replicant.us. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Additional details are provided at phoronix.com. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Affected

• Samsung Nexus S I902x
• Samsung Galaxy S I9000
• Samsung Galaxy S 2 I9100
• Samsung Galaxy Note N7000
• Samsung Galaxy Nexus I9250
• Samsung Galaxy Tab 2 7.0 P31xx
• Samsung Galaxy Tab 2 10.1 P51xx
• Samsung Galaxy S 3 I9300
• Samsung Galaxy Note 2 N7100

Productinfo

Type

• Smartphone Operating System

Vendor

• Samsung

Name

• Galaxy
• Nexus

License

• commercial

Website

• Vendor: https://www.samsung.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion