Dancing with Exynos Coprocessor: Pwning Samsung for fun and “profit”

Dancing with Exynos Coprocessor: Pwning Samsung for fun and “profit”

Speakers: Bing-Jhong Jheng (Principal Researcher, STAR LABS); Muhammad Ramdhan (Principal Researcher, STAR LABS); Pan ZhengPeng (Principal Researcher, STAR LABS SG)

Conference: CODE BLUE

YouTube: https://www.youtube.com/watch?v=ACc0IY9xBOQ

Overview

This talk, "Dancing with Exynos Coprocessor: Pwning Samsung for fun and 'profit'," delivered by researchers from STAR LABS, delves into the critical security vulnerabilities discovered within Samsung's proprietary Exynos System-on-Chip (SOC), specifically targeting its Neural Processing Unit (NPU) coprocessor. The presentation by Bing-Jhong Jheng, Pan ZhengPeng, and Muhammad Ramdhan unveils a trove of 13 unique bugs, some of which are exploitable to achieve arbitrary kernel read/write primitives and ultimately gain root access on modern Samsung devices, including the latest S24 series. The research highlights the inherent security risks introduced by new, complex hardware components and their associated drivers, particularly when they operate with elevated privileges within the Android kernel.

The significance of this research cannot be overstated. Samsung, a global leader in mobile technology, increasingly integrates its own Exynos SOCs into a wide range of devices, from flagship smartphones to mid-range models. The NPU, designed to accelerate AI and machine learning tasks, represents a growing attack surface due to its direct interaction with the Android application processor and its access to critical system resources. The discovery of numerous high-impact vulnerabilities—including double frees, out-of-bounds accesses, and arbitrary kernel free bugs—underscores the challenges in securing these complex, rapidly evolving hardware ecosystems against sophisticated attackers. This talk serves as a stark reminder that despite continuous advancements in Android kernel security mitigations, novel attack vectors persist, demanding continuous vigilance and thorough security auditing.

Background

▶ Watch: Introduction: Pwning Samsung Exynos Coprocessor (0:00)

Modern Android kernel security is fortified with a robust suite of mitigations designed to thwart exploitation attempts. These include Kernel Address Space Layout Randomization (KASLR), Control Flow Integrity (CFI), Pointer Authentication Codes (PAC), Memory Tagging Extensions (MTE) (though MTE is primarily found on Pixel devices), and various kernel configuration options like init_debug_list. Beyond these, Samsung incorporates its own device-specific mitigations, such as defex and physical ASLR. Despite these layers of defense, the attack surface of Android devices remains vast and multifaceted.

The speakers classify Android exploit attack surfaces into four main categories:

1. Universal: Vulnerabilities affecting core Android ecosystem components (e.g., Linux kernel, binder IPC, TCP/UDP sockets) that impact almost any Android phone.
2. Chipset Specific: Bugs tied to a particular SOC component (e.g., Mali GPU, Exynos NPU) that affect all devices using that specific chipset.
3. Vendor Specific: Issues within a vendor's proprietary drivers (e.g., Samsung's filesystem drivers) that are typically more limited in scope.
4. Module Specific: Unique attack surfaces per mobile phone model (e.g., Wi-Fi, JSP).

The focus of this research lies firmly in the chipset specific category, targeting the Samsung Exynos NPU. The motivation for choosing Samsung's Exynos SOC is compelling: Samsung is heavily investing in its own SOC development, with Exynos chips widely deployed across various regions. Critically, both the Exynos NPU and Exynos GPU are accessible from the application layer, meaning an untrusted application can open and interact with their device nodes. This accessibility, combined with the continuous addition of new code to Samsung's proprietary SOCs and a history of past NPU/GPU vulnerabilities, makes the Exynos NPU a prime target for local privilege escalation (LPE) attacks. The researchers' choice proved fruitful, leading to the discovery of a significant number of vulnerabilities within a relatively short period.

Key Findings

▶ Watch: CVE-2025-23097: Out-of-bounds write for PC control (7:00)

Over just one month of dedicated research, the STAR LABS team identified a staggering 13 unique vulnerabilities within the Samsung Exynos SNO MPU driver. These bugs, assigned CVEs in the 2025-23xxx range, span a variety of critical vulnerability types, demonstrating systemic issues within the NPU driver's code quality and security. The discovered bugs include:

• CVE-2025-23095: A double free vulnerability in prepare_imb_info, where a pointer to imb_info was not cleared after an error path, allowing it to be freed again in undo_s_graph.
• CVE-2025-23097: An out-of-bounds write in mpu_test_ioctl, caused by unchecked user-supplied type_index accessing the NPU profile area, which has a fixed size of 20 items. Exploiting this could lead to kernel PC control by overwriting a function pointer.
• CVE-2025-23098: Another double free in vb_mapping_dma_buffer, where dma_buffer pointers were not cleared after unmapping, compounded by different locks used by mpu_vertex_unprepare and mpu_vertex_flush_p, allowing concurrent access and double freeing.
• CVE-2025-23099: An out-of-bounds access in mpu_q_allocate. If NPU_Q_STATE_ALLOCATE is already set, mpu_q_allocate will return success without re-allocating, but subsequent operations can process user data with a larger, malicious count, leading to out-of-bounds access on the original, smaller allocated object. This bug was chosen for detailed exploitation.
• CVE-2025-23100: This CVE encompasses two distinct Denial of Service (DoS) bugs. The first is a null-pointer dereference in mpu_dma_fence_to_sync due to an unchecked fence pointer after a user closes a file descriptor and reopens a different type with the same FD number. The second is a firmware-level watchdog timer reset triggered by calling WS4L_VERTEX_IOC_BOOTUP_INIT with different types, crashing the Application Processor.
• CVE-2025-23101: A highly impactful arbitrary kernel free bug in ws4l_profile_node_child. An array designed to hold three items was only processed for two in a loop, leaving the third item's address controllable by user space. This user-controlled address is then passed to a free function, providing a powerful arbitrary free primitive. This bug was also selected for detailed exploitation.
• CVE-2025-23102: A double free in webq_stop, where q_ptr_format_formats was freed without clearing the pointer, allowing it to be freed again by calling WS4L_VERTEX_IOC_STREAM_ON and WS4L_VERTEX_IOC_STREAM_OFF sequentially twice.
• CVE-2025-23103: An out-of-bounds write in mpu_update_assign. The function uses a user-provided c->count to iterate through a loop without validating it against q_list->count, leading to out-of-bounds access on q_container and potential arbitrary writes.
• CVE-2025-23107: Another out-of-bounds read/write similar to CVE-2025-23103 but in a different function, we_fill_vs4l_buffer. It fails to check if the user-provided buffer_in_container array is smaller than the actual size, leading to out-of-bounds reads or arbitrary reads with proper heap layout.

A crucial observation was that not all bugs affect all Exynos models. For instance, CVE-2025-23101 was specific to Exynos 1380, while others like CVE-2025-23099 affected both higher-end (Exynos 2400) and lower-end (Exynos 1480) models. The good news for attackers (and bad news for Samsung) is that most of these bugs were found to be exploitable, providing ample opportunities for privilege escalation.

Technical Deep Dive

▶ Watch: Exploiting arbitrary free to bypass KASLR (18:00)

The researchers selected two particularly impactful vulnerabilities for in-depth exploitation: CVE-2025-23101 (arbitrary kernel free) and CVE-2025-23099 (out-of-bounds access leading to arbitrary read/write).

CVE-2025-23101: Arbitrary Kernel Free in ws4l_profile_node_child

This vulnerability is a classic example of a boundary condition error. In the ws4l_profile_node_child function, an array named child_array is intended to store addresses from user space. The function includes a loop that copies data from user space to a kernel address (kp) and then assigns temp_kp to child_array. The critical flaw lies in the loop's iteration count: it only processes two items, despite child_array being capable of holding three items.

As a result, the last item in child_array (at index 2) is never properly initialized or updated by the kernel. This means that if an attacker can control the memory region where child_array[2] resides, they can inject an arbitrary kernel address. When a subsequent function, free_ws4l_profile_node, is called, it iterates through all three items in child_array and calls kfree() on each. If child_array[2] contains a user-controlled kernel address, this effectively provides an arbitrary kernel free primitive. This is a powerful primitive for exploitation, as it can be used to free critical kernel objects, leading to use-after-free conditions or other memory corruption. Samsung's patch was straightforward: extend the loop to process all three items in the array, preventing the user-controlled address from being freed.

CVE-2025-23099: Out-of-Bounds Access in mpu_q_allocate

This bug revolves around the management of input and output queues within the NPU driver. The NPU driver utilizes structures like NPU_Q and NPU_VERTEX_CONTEXT which contain fixed-size arrays for queues (in_q, out_q), and within each queue, there are containers, and within each container, there are buffers. When allocating a new queue via an ioctl, the mpu_q_prepare function calls mpu_q_alloc and then mpu_alloc_q.

The vulnerability arises because of an insufficient check in mpu_q_allocate. Before allocating a new queue, the driver checks if the NPU_Q_STAT flag is set. If this flag is already set (indicating a queue has been previously allocated), mpu_q_allocate will simply return 0 (success) without performing any new allocations for containers or buffers. However, the mpu_q_mapping function, which is called subsequently, will then assign a user-provided count variable to the allocated containers.

This means an attacker can first allocate a queue with a small number of containers/buffers. Then, by calling mpu_q_allocate again (which will return success due to NPU_Q_STAT being set) and subsequently mpu_q_mapping with a larger user_provided_count_for_mapping, the container_count (and buffer counts within containers) can be overwritten to a value exceeding the actual allocated size. This leads to out-of-bounds access when iterating through these objects, providing powerful read/write primitives. Samsung patched this by returning an E_ERROR_INVALID if mpu_q_allocate is called a second time when NPU_Q_STAT_ALLOCATED is already set, preventing the count override.

Demo / Proof of Concept

▶ Watch: Chaining OOB writes for arbitrary kernel R/W (26:00)

The STAR LABS team developed full exploitation chains for CVE-2025-23101 and CVE-2025-23099 to achieve root access on Samsung Exynos devices.

Exploiting CVE-2025-23101: Arbitrary Kernel Free

This exploit targeted the Exynos 1380 and demonstrated a bypass for common Android kernel mitigations.

1. KASLR and Heap Randomization Bypass: Modern Android kernels employ KASLR and heap randomization, making it difficult to predict kernel object addresses. The researchers found that by repeatedly rebooting the device and collecting kernel object addresses, they could identify a likely address for certain objects. They chose socket buffers as their target for heap spraying, as these objects are relatively easy to predict, don't cause out-of-memory errors, and are easily reclaimable.
2. Arbitrary Free and Reclaim:

• The exploit first sprays a large number of socket buffers into the kernel heap.
• It then triggers CVE-2025-23101 to perform an arbitrary free on a chosen socket buffer by providing its likely address to ws4l_profile_node_child_func via the WS4L_VERTEX_IOC_PROFILE_ON ioctl.
• Immediately after freeing the socket buffer, the exploit reclaims the freed memory as a pipe buffer object. Pipe buffers are advantageous because their pipe_ops structure contains function pointers, which can be leaked to bypass KASLR.
• By reading from the reclaimed pipe buffer, the exploit can obtain the address of pipe_ops, confirming successful reuse and providing a kernel address leak.

1. SELinux Disabling:

• With a kernel address leak, the exploit can locate the SELinux data address in kernel memory.
• The exploit then sprays socket buffers again, this time with the SELinux data address as the target.
• It then reclaims the freed socket buffer (which now overlaps with SELinux data) and writes a value of 0 to disable SELinux. This is possible because Samsung Exynos does not implement SELinux developer disabled or protect SELinux state with the KOS E2 hypervisor.

1. Root Shell: With SELinux disabled and arbitrary kernel read/write, the path to root is clear. The exploit overrides a shell library (e.g., libc) and hijacks the init process to pop a reverse root shell.

Alternative Approach (Page Tables): The researchers also explored using page tables for spraying. Since Exynos devices lack physical memory slide, page table entries can be reclaimed as AIO pages (being of the same order and migrate type). This allows direct rewriting of page table entries from user space, offering another path to arbitrary kernel read/write.

Exploiting CVE-2025-23099: Out-of-Bounds Write to Arbitrary Read/Write

This exploit leverages the ability to control object sizes within the NPU driver's queues.

1. Out-of-Bounds Primitives: The CVE-2025-23099 vulnerability provides three distinct out-of-bounds primitives:

• Out-of-bounds Read: If the number of buffers is larger than the actual allocated object size, fill_vs4l_buffer (reachable via ioctl Qbuff bundle cancel) can read past the bounds of the buffer.
• Arbitrary Read: If the number of containers is larger than the actual allocated object, containers can be made to point out-of-bounds. If the attacker can control this out-of-bounds data, they can control buffer pointers to achieve arbitrary reads.
• Heap Out-of-Bounds 4-byte Write: If the number of buffers in a container is larger than the actual object, a limited 4-byte write can be performed out-of-bounds via buffer_AOI_offset. This write is limited in size and offset.

1. Heap Shaping and Chaining Primitives: To achieve full arbitrary kernel read/write, the researchers chained these primitives:

• Initial Heap Spray: The heap is carefully shaped by allocating objects (e.g., in kmalloc-1k) such that a victim buffer object is adjacent to a victim container object.
• Limited Pointer Overwrite: Using the 4-byte out-of-bounds write primitive, the exploit overwrites the first byte of the victim container's buffer pointer. This is a partial overwrite due to the 4-byte limitation.
• Second Heap Spray: Another heap spray is performed (e.g., in kmalloc-512), creating victim buffers adjacent to a second set of victim containers.
• Address Leak and Manipulation: The exploit uses an out-of-bounds read on the first victim container to leak the address of its buffer pointer (which points to the kmalloc-1k victim buffers). This leaked address is then incremented to point to the second victim containers (in kmalloc-512).
• Full Pointer Control: The limited 4-byte write on the first victim container is then used again, this time to add 4 to the buffer pointer, allowing control over a higher byte of the second victim container's buffer pointer. By strategically combining these partial writes and address manipulation, the researchers achieved full 8-byte control over the buffer pointer in the second victim container.
• Arbitrary Read/Write: With full control over a buffer pointer in the second victim container, the exploit gained an arbitrary kernel read/write primitive.

1. Root Shell: Similar to the CVE-2025-23101 exploit, once arbitrary kernel read/write is achieved, the exploit disables SELinux and overrides libc to hijack the init process, granting a root shell.

Defensive Implications

▶ Watch: Q&A: Mitigating these bugs with MTE (33:00)

This research offers several crucial insights for defenders and highlights areas requiring urgent attention:

• New SOCs and Drivers Introduce New Bugs: The rapid development and integration of proprietary hardware components, like the Exynos NPU, inevitably introduce new codebases and, consequently, new vulnerabilities. Thorough security auditing and robust testing must be integrated into the entire development lifecycle of these components.
• Mitigation Gaps: While Android and Samsung implement various security mitigations, their effectiveness is limited if they are not universally deployed or if critical components bypass them. The absence of Memory Tagging Extensions (MTE) on Samsung devices, which could have prevented many of the memory corruption bugs, is a significant gap. Additionally, the lack of SELinux developer disabled protection and the fact that SELinux state is not protected by a hypervisor on Exynos devices made SELinux bypass trivial.
• Fragmented Source Management is Vulnerable: The revelation that Samsung considers Exynos NPU bugs "not eligible" for its Important Scenario Vulnerability Program (ISVP) because they are handled by a "different company" points to a fragmented security ownership model. This detachment can lead to slower patch cycles, lower bug bounties, and a reduced sense of urgency, making the platform more vulnerable.
• Code Auditing Remains Highly Effective: The researchers explicitly stated that all 13 bugs were found through code auditing, not extensive fuzzing. This underscores the continued importance of manual security reviews and expert analysis, especially for complex, high-privilege drivers.
• Physical Memory Slide: The absence of physical memory slide on Exynos devices simplifies exploitation by allowing attackers to directly manipulate page table entries from a linear map address, bypassing a common KASLR-related defense.

Defenders should push for the widespread adoption of robust memory safety mitigations like MTE across all Android devices, regardless of vendor. Additionally, security teams must advocate for unified vulnerability management programs that cover all components of an SOC, irrespective of internal organizational boundaries, ensuring that critical bugs receive appropriate recognition and prompt remediation.

Key Takeaways

• New hardware, new vulnerabilities: The rapid evolution of proprietary SOCs like Exynos and their associated drivers is a significant source of critical security bugs, requiring continuous scrutiny.
• Systemic memory safety issues: The prevalence of double free and out-of-bounds vulnerabilities points to fundamental memory management issues within the Samsung Exynos NPU driver.
• Mitigation gaps on non-Pixel devices: Samsung Exynos devices lack advanced mitigations like MTE, making exploitation of memory corruption bugs significantly easier compared to devices with more comprehensive protections.
• Fragmented ownership hinders security: The "different company" excuse for bug bounty eligibility highlights an organizational challenge that can lead to delayed fixes and lower perceived severity for critical vulnerabilities.
• Code auditing is paramount: All 13 bugs were discovered through manual code auditing, demonstrating its effectiveness in uncovering deep-seated vulnerabilities in complex driver code.
• Full root possible from untrusted app: Despite multiple Android and Samsung mitigations, these bugs allowed attackers to gain arbitrary kernel read/write and achieve full root access from an untrusted application.

About the Speaker(s)

Bing-Jhong Jheng (Billy) is a Principal Researcher at STAR LABS. His research primarily focuses on Android kernel security, and he has previously shared his findings at renowned security conferences such as HITCON and KREU.

Pan ZhengPeng (Peter) is a Principal Researcher at STAR LABS SG. He conducts research on both iOS and Android platforms, bringing a broad mobile security perspective. His past research has been presented at prominent conferences including Black Hat, ZeroNights, and OffensiveCon.

Muhammad Ramdhan is a Principal Researcher at STAR LABS, specializing in Linux kernel and Android security. He is a seasoned speaker, having shared his research at conferences like Defcon and HITCON.