Skip to content

Latest commit

 

History

History
60 lines (48 loc) · 6.79 KB

attack-tree.md

File metadata and controls

60 lines (48 loc) · 6.79 KB

Attack Tree Analysis for tiann/kernelsu

Objective: Gain Unauthorized Root Access and/or Exfiltrate Data (via KernelSU)

Attack Tree Visualization

                                     Gain Unauthorized Root Access and/or Exfiltrate Data (via KernelSU)
                                                        /                                   |                                           
                                                       /                                    |                                           
               [HIGH-RISK] Exploit KernelSU Core Vulnerabilities       [HIGH-RISK] Exploit KernelSU Module Vulnerabilities       Abuse Legitimate KernelSU Features
                                      /        |                                           |                                           |
                                     /         |                                           |                                           |
                            1. Buffer   2. Race                                   4. Module Loading                               8.  Misuse
                            Overflow  Condition                                     Bypass                                     SU Grant
                           [CRITICAL] [CRITICAL]                                  [CRITICAL]                                    [HIGH-RISK]

Attack Tree Path: High-Risk Path 1: Root > Exploit KernelSU Core Vulnerabilities > Buffer Overflow [CRITICAL]

  • Node: Buffer Overflow [CRITICAL]
    • Description: A classic vulnerability where an attacker provides more input data than a buffer can handle, overwriting adjacent memory in the kernel. This can lead to arbitrary code execution within the kernel context.
    • Attack Vectors:
      • Malicious Module Request: A specially crafted module request with oversized parameters sent to a KernelSU system call that lacks proper input validation.
      • Manipulated Configuration: A tampered KernelSU configuration file containing excessively long strings in fields that are not properly size-checked when loaded.
      • Inter-Process Communication (IPC): If KernelSU uses IPC, a malicious application could send an oversized message to a KernelSU component.
      • Exploiting a Vulnerable Kernel Interface: If KernelSU interacts with other kernel interfaces, a buffer overflow in that interface could be triggered through KernelSU.

Attack Tree Path: High-Risk Path 2: Root > Exploit KernelSU Core Vulnerabilities > Race Condition [CRITICAL]

  • Node: Race Condition [CRITICAL]
    • Description: A vulnerability where the outcome of a KernelSU operation depends on the unpredictable timing of multiple threads or processes within the kernel. Exploiting this can lead to privilege escalation or denial of service.
    • Attack Vectors:
      • Permission Granting/Revocation Race: Rapidly requesting and revoking permissions for a module or application, hoping to catch KernelSU in an inconsistent state where permissions are granted incorrectly.
      • Module Loading/Unloading Race: Attempting to load or unload a module while another process is interacting with it, potentially leading to a use-after-free or double-free vulnerability.
      • Resource Management Race: Exploiting a race condition in how KernelSU manages kernel resources (memory, file descriptors, etc.), potentially leading to resource exhaustion or corruption.
      • Signal Handling Race: If KernelSU uses signal handlers, a race condition between the signal handler and the main thread could be exploited.

Attack Tree Path: High-Risk Path 3: Root > Exploit KernelSU Module Vulnerabilities > Module Loading Bypass [CRITICAL]

  • Node: Module Loading Bypass [CRITICAL]
    • Description: Bypassing KernelSU's security mechanisms to load a malicious, unsigned, or otherwise untrusted module. This allows the attacker to execute arbitrary code with root privileges.
    • Attack Vectors:
      • Signature Forgery: Creating a fake digital signature that appears to be valid for a malicious module.
      • Signature Verification Bypass: Exploiting a vulnerability in the code that verifies module signatures, causing it to accept an invalid signature.
      • Checksum Bypass: Modifying a legitimate module and then finding a way to bypass the checksum verification that should detect the modification.
      • Loading from Untrusted Source: Tricking KernelSU into loading a module from an untrusted location (e.g., a malicious website or a compromised file share) instead of the designated module repository.
      • Exploiting a Vulnerability in the Module Loader: Finding a flaw in the code that loads modules, allowing it to load a module that should have been rejected.

Attack Tree Path: High-Risk Path 4: Root > Abuse Legitimate KernelSU Features > Misuse SU Grant Logic [HIGH-RISK]

  • Node: Misuse SU Grant Logic [HIGH-RISK]
    • Description: Tricking a user or another application into granting root access to a malicious application via KernelSU's intended functionality. This does not involve exploiting a technical vulnerability in KernelSU itself, but rather misusing its features.
    • Attack Vectors:
      • Social Engineering: Creating a malicious application with a misleading name, icon, or description that requests root access, making the user believe it's a legitimate request. For example, a fake "System Update" app.
      • Misleading Prompt: Crafting a prompt that obscures the true purpose of the root access request, making it seem less dangerous than it is.
      • Exploiting a Vulnerable Rooted Application: If another application already has root access (granted legitimately), a malicious application could exploit a vulnerability in that application to perform actions on its behalf, effectively gaining root access indirectly.
      • Clickjacking/Overlay Attack: Using a transparent overlay to trick the user into tapping the "Grant" button on the SU prompt when they think they are interacting with a different application.
      • Prompt Fatigue: If the user is constantly bombarded with legitimate root access requests, they may become less cautious and grant access to a malicious request without careful consideration.