Reverse Engineering Android Kernel Modules: Finding UAF Vulnerabilities in the Wild

Introduction to Android Kernel Modules and UAF Vulnerabilities

Android’s security model heavily relies on the Linux kernel. Kernel modules are dynamic extensions to the kernel, loaded on demand to provide specific functionalities, often interacting directly with hardware or privileged system resources. While offering flexibility, these modules represent a critical attack surface. A single vulnerability within a kernel module can bypass Android’s robust sandboxing mechanisms, leading to local privilege escalation (LPE) or even arbitrary code execution at the highest privilege level.

One of the most potent and frequently exploited classes of vulnerabilities in kernel-level code is the Use-After-Free (UAF). A UAF occurs when a program frees a block of memory but then, due to an error in logic, attempts to access or reuse that freed memory. If an attacker can control the contents of the memory that gets reallocated into the freed region, they can achieve powerful primitives like arbitrary read/write, control flow hijacking, or even remote code execution.

Setting Up Your Reverse Engineering Environment

Prerequisites and Tools

Before diving into the intricate world of kernel module analysis, ensure you have the following:

Rooted Android Device or Emulator: For extracting modules and dynamic testing. An Android AOSP build running in QEMU is ideal for kernel debugging.
ADB (Android Debug Bridge): For interacting with the device.
Kernel Source Code/Headers: Matching your target device’s kernel version. This is invaluable for symbol resolution and understanding kernel APIs.
Disassembler/Decompiler: IDA Pro (with ARM64 support) or Ghidra are indispensable for static analysis.
Linux Utilities: readelf, strings, objdump for initial module inspection.
Cross-Compilation Toolchain: For compiling exploit proof-of-concepts (PoCs) for ARM/ARM64.

Acquiring and Analyzing Kernel Modules

Extracting Modules from Device

Kernel modules (`.ko` files) are typically found in `/vendor/lib/modules` or `/system/lib/modules` on an Android device. You can pull them directly using ADB:

adb pull /vendor/lib/modules/module_name.ko .

For some devices, modules might be packaged within `modules.img` or part of the `boot.img` or `vendor_boot.img`. You’d need tools like `unmkbootimg` or `unyaffs` to extract them, or mount the image as a loop device.

Initial Static Analysis with Disassemblers

Once you have the `.ko` file, load it into IDA Pro or Ghidra. The first steps involve:

Identify Entry Points: Look for `module_init` and `module_exit` functions. These are the module’s constructors and destructors.
Locate File Operations Structure: Many kernel modules expose a character device interface to user space. Search for `struct file_operations` definitions. This structure often contains pointers to the module’s handler functions, such as `open`, `release`, `read`, `write`, and most importantly for exploit development, `unlocked_ioctl` or `compat_ioctl`.
Identify IOCTL Handlers: The `ioctl` handler is a prime target as it allows user-controlled input to interact with kernel-level data structures and memory operations. Cross-reference the `unlocked_ioctl` pointer found in the `file_operations` structure.
String Analysis: Use the `strings` utility or your disassembler’s string view to identify device names (e.g., `/dev/vulnerable_device`), error messages, and potential debug strings. This helps map user-space interactions to kernel functions.

Identifying UAF Patterns in Kernel Module Code

Common UAF Scenarios

When analyzing the `ioctl` handler or other module functions, look for these UAF patterns:

Allocation/Deallocation Mismatch: A code path allocates memory (e.g., `kmalloc`), but another path frees it without clearing the pointer, leading to a subsequent use.
Double Free: Calling `kfree` twice on the same pointer without an intervening reallocation.
Race Conditions: In multi-threaded scenarios, one thread frees a resource while another thread is still using it, or attempts to use it shortly after.
Error Path UAF: Memory is allocated, an error occurs, the memory is freed, but the error handling path continues to use the freed pointer.

Disassembly Walkthrough (Hypothetical Example)

Consider a simplified `ioctl` handler for a hypothetical device driver. We’re looking for a UAF due to a failure to nullify a pointer after freeing its associated memory.

<code class=

Android Mobile Specs & Compare Directory

Are you researching mobile hardware properties, processor SoCs, GPU chipsets, or RAM configurations? Access our complete specs catalog to compare up to 5 devices side-by-side!

Compare Devices Specs →