Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Motorola Kernel Vulnerability Used to Unlock Droid Devices

A researcher known for unlocking Motorola handsets, has leveraged a vulnerability in the TrustZone kernel to bypass the bootloader restrictions on several devices sold by Verizon.

A researcher known for unlocking Motorola handsets, has leveraged a vulnerability in the TrustZone kernel to bypass the bootloader restrictions on several devices sold by Verizon.

The devices that have been proven vulnerable are the Motorola Razr HD, Razr M, and Atrix HD devices. According to the researcher, as well as a NVD outline, the Qualcomm MSM8960 chipset doesn’t verify the association between a physical address argument and a memory region. Thus, a user can unlock bootloader using specially crafted SMC operations.

However, the tools needed have already been released to the public, making the task of exploiting the flaw easily accomplished by anyone who desires an unlocked device. Dan Rosenberg, the researcher who discovered the kernel flaws, described his process in a blog post last week.

“At this point, the end was in sight, but I knew I would need a vulnerability in the TrustZone kernel in order to set this flag (0x2) to zero, allowing my SMC call to blow the QFuse required to unlock the bootloader,” he remarked

“Fortunately, I didn’t have to look long, since one of the other SMC commands in the same section of the TrustZone kernel contains a fairly obvious arbitrary memory write vulnerability…”

While important, and certainly something that needs fixed, the vulnerability that Rosenberg discovered isn’t earth shattering to the enterprise. However, it’s important to remember that should an employee have an unlocked (rooted) device, and use the tools recently made available to unlock the bootloader, then that could cause problems with MDM solutions or other corporate applications.

Additional details are available here

Written By

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Vulnerabilities

Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.