Memory Corruption via Race Condition in Android

Executive Summary

This vulnerability is a race condition in the Android kernel's KVM (Kernel-based Virtual Machine) implementation for ARM64 architecture. It occurs during CPU power state transitions in protected virtual machines, specifically when handling PSCI (Power State Coordination Interface) operations like CPU_ON. The issue allows a guest CPU_ON operation failure to incorrectly set a CPU's power state to OFF instead of ON_PENDING, causing inconsistent states that may lead to memory corruption or privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the Android kernel's KVM implementation for ARM64 architecture and involves race conditions in CPU power state transitions. Detection requires kernel-level inspection and may not be feasible through standard network commands. Check kernel logs for KVM-related errors or warnings, particularly around PSCI operations or CPU power state transitions. Commands like dmesg | grep -i kvm or journalctl -k | grep -i kvm may help identify anomalies.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow a local attacker to escalate privileges on an affected Android device without needing additional permissions or user interaction. It may also cause system instability, crashes, or denial-of-service conditions by corrupting memory or triggering traps in the hypervisor layer.

Useful 0 Not Useful 0

Mitigation Strategies

• Apply the Android kernel patches referenced in the provided resources, particularly those addressing race conditions in KVM for ARM64 (e.g., commits f6510cfbc728061d7a8d4ea4ac91e5fc270aaf6b, eb970aae88c0f45056f4501b7815a9b5c7ab0435).
• Update to the latest stable version of the Android kernel that includes these fixes.
• Monitor for unusual CPU behavior or crashes in virtualized environments, as these may indicate exploitation attempts.
• Restrict access to KVM functionality where possible, limiting exposure to untrusted users or guests.

Useful 0 Not Useful 0