Rokhaya-Diamil Fall and Philipp Mao, EPFL; Martin Wagner, Asymmetric Research; Mathias Payer, EPFL
Arbitrary file overwrite vulnerabilities are common in Android apps. However, the security impact of such vulnerabilities has so far been highly app-dependent. We present a new, app-agnostic, persistent technique that turns arbitrary file overwrites into code execution by targeting the runtime-generated app image file. This file is used by the Android Runtime to cache a snapshot of the app’s classes and is writable within an app’s sandbox. By replacing this file with a malicious image, attackers gain code execution when the app restarts.
We describe two exploitation strategies: a local attack that, assuming an ASLR leak, leverages an arbitrary memory write during image decompression to corrupt Android Runtime objects and hijack control flow. More importantly, we demonstrate a remote attack that requires no ASLR leak and instead abuses image relocation logic to inject and execute attacker-controlled Dalvik bytecode.
We demonstrate the practicality of both techniques by exploiting real n-day or 0-day arbitrary file overwrite vulnerabilities on commercial phones. We showcase the local technique with a zero-click privilege escalation chain from an untrusted app to the system user, exploiting an arbitrary file overwrite in the OnePlus backup app. We present the remote technique by exploiting the same file overwrite vulnerability over the network. To further demonstrate the remote technique, we present a new variant of the Pwn2Own24 Galaxy S24 chain, which leveraging our remote technique, now achieves code execution in the privileged platform_app context. We reveal the security impact of arbitrary file overwrite vulnerabilities in Android apps and present memory corruption exploitation in the Android Runtime.
