OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others
summary
The author demonstrates a highly reliable and portable method for gaining root access on Android devices by targeting vulnerabilities in code written by Original Equipment Manufacturers (OEMs) rather than generic Linux or chipset drivers. By combining a userspace sandbox escape to bypass SELinux policies with a page Use-After-Free (UAF) vulnerability in an OEM kernel driver, the attacker can achieve a stable physical page-level primitive. This strategy allows for successful exploitation across a wide range of flagship devices from Samsung, Xiaomi, and Oppo/OnePlus/Realme, bypassing modern kernel hardening like KASLR and CFI.
key points
- Targeting OEM-specific code provides better portability and universality within a brand's lineup because the same drivers are often shipped across different chipsets and kernel versions for a single OEM.
- The use of a page Use-After-Free (UAF) vulnerability is particularly effective because it creates a data-only primitive that ignores slab-based hardening and does not require a KASLR leak or control-flow hijacking.
- The initial sandbox escape leverages logic flaws in OEM-specific Inter-Process Communication (IPC) handlers to move from an unprivileged app to a more privileged domain that can access the vulnerable kernel driver.
who should read it
Security researchers and Android developers interested in kernel exploitation, sandbox escapes, and the effectiveness of modern Android security mitigations.
discussion mixed
consensus
Most commenters agree that rooting a primary Android phone is generally not worth the risk due to the loss of system integrity and the fact that many essential apps, particularly banking and government services, block rooted devices. While some argue that root access is essential for true ownership and privacy, the prevailing sentiment is that the security tradeoffs are significant. For specific tasks like migrating MFA seeds, users suggest alternative methods like GDPR requests or using secondary devices to avoid compromising a main phone.
top insight
A highly practical alternative to rooting for Authy users is submitting a GDPR/Subject Access Request to Twilio, which can force the provider to send the TOTP seeds in an encrypted CSV. This allows users to migrate to open-source alternatives like Aegis without needing root access or manually regenerating every single seed, bypassing Authy's intentional lack of export features.
Generated by an LLM from the article and thread. Check the sources before relying on it.