UNISOC T612 Modem-to-Kernel Local Privilege Escalation

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://ssd-disclosure.com/unisoc-t612-lpe
• Blog Title: UNISOC T612 Modem-to-Kernel Local Privilege Escalation
• Suggested Section: Mobile Pentesting → Android Pentesting → Baseband/Modem and SoC Isolation Exploitation, with cross-references from Binary Exploitation and Telecom Network Exploitation

🎯 Content Summary

Overview, root cause, and severity

The post discloses a critical modem-to-kernel local privilege-escalation vulnerability in devices using the UNISOC T612 chipset. It is classified as CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC); the post does not assign a CVE identifier. The fundamental failure is that, from the modem context, modem memory is not properly isolated from the Android/Linux application-processor kernel's phy...

🔧 Technical Details

Turning coprocessor execution into kernel compromise through an unprotected MPU: After obtaining code execution on a modem or another SoC coprocessor, inspect whether its MPU, firewall, or bus permissions prevent access to application-processor memory. On the affected platform, selecting MPU region 0 and configuring it as a base-zero, full-address-space RWX region gives modem code unrestricted physical-memory access. CP15 configuration writes must be followed by synchronization barriers such as DSB and ISB. If kernel physical memory is reachable, the coprocessor compromise becomes a kernel arbitrary-read/write and code-execution primitive.

Staging executable fragments through malformed protocol fields: When a parser vulnerability allows only small binary fragments to be placed at useful memory offsets, divide an executable hunter into fixed-size stages and use protocol-controlled padding or repeated attributes to posi...

🤖 Agent Actions

Implemented the HackTricks update.

Added

• src/mobile-pentesting/android-app-pentesting/baseband-and-soc-isolation-exploitation.md
  • Modem-to-kernel isolation failures
  • Cortex-R7 MPU reconfiguration
  • SIP/SDP fragment staging and egg hunting
  • IMS AKA authentication
  • Physical address translation
  • AArch64 kernel-text trampoline hooking
  • Numbered citations to both SSD primary sources

Cross-referenced from

• Android pentesting index
• Telecom network exploitation
• Binary arbitrary-write exploitation
• src/SUMMARY.md

Validation passed for formatting, citations, relative links, duplicate links, forbidden sources, and git diff --check. mdbook was unavailable, so a full book build was not run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://ssd-disclosure.com/unisoc-t612-lpe

Content Categories: Based on the analysis, this content was categorized under "Mobile Pentesting → Android Pentesting → Baseband/Modem and SoC Isolation Exploitation, with cross-references from Binary Exploitation and Telecom Network Exploitation".

Repository Maintenance:

• MD Files Formatting: 990 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0