Two published flaws in Unisoc modem firmware let a video call run code on the modem and then take over the Android kernel. Unisoc has not responded and there is no vendor fix. We patched the modem ourselves, made sure it cannot change the kernel's code, and hardened the interface between them.
What the vulnerability is
Independent security researcher 0x50594d, working with SSD Secure Disclosure, found and published two flaws in the modem firmware shared by several Unisoc chips: the T606, T612, T616 and T7250. These chips are used in budget phones from Motorola, Xiaomi and Realme. The OhrTech Aleph uses the T606.
Stage one: code on the modem, from a video call. The modem mishandles the session description carried in the signalling that sets up a video call. A specially crafted call corrupts the modem's memory and can run the attacker's code on it. Read the researcher's write-up of the modem flaw.
Stage two: from the modem to the Android kernel. Code running on the modem can switch off the modem's own memory protection, then read and write all of the device's physical memory, including the Android kernel's code. Read the researcher's write-up of the kernel escalation.
Together, the two give an attacker full control of the phone from a single video call. The researchers demonstrated the chain on their own test cellular network, against a Motorola E13, a Xiaomi Redmi A5 and a Realme C33.
What the chip maker did
Nothing. SSD reports that it tried to reach Unisoc through several channels before each publication and received no response. No CVE has been assigned, and Unisoc has not fixed the flaw, even in its newest modem firmware.
This is typical of the market rather than rare: more than 40% of Android devices in the world no longer receive security updates at all.
What we did
We patched the modem ourselves. With no fix coming from Unisoc, we corrected the flaw in the modem firmware directly. The patched modem ships on every OhrTech device.
The modem cannot change the kernel's code. Stage two works by writing into the kernel. A hardware memory monitor now guards the kernel's code and read-only data: any write to them from the modem, or from any other peripheral, halts the device the moment it happens. On restart, the kernel is loaded again from the signed, verified image.
We hardened the interface between the modem and the kernel. The kernel talks to the modem and the device's other processors through shared memory. We audited that channel, now treat those processors as untrusted, and fixed 13 places where values the modem controls could steer the kernel's memory accesses, copy lengths or array indices. A compromised modem can no longer use the channel to read or write arbitrary kernel memory.
Who needs to act
Nobody. All three changes are part of the Foundation OS that every OhrTech device runs.
Engineers who want more technical detail can ask us directly through the engineering contact.
Credit
Both flaws were found by 0x50594d and published by SSD Secure Disclosure. Thank you for the careful research and the public write-ups. Weakness classes: CWE-674 (uncontrolled recursion) and CWE-1189 (improper isolation of shared resources on a system-on-chip).
Timeline
- SSD Secure Disclosure publishes the modem remote code execution flaw. Unisoc did not respond.
- SSD Secure Disclosure publishes the escalation from the modem to the Android kernel. Unisoc did not respond.
- OhrTech publishes this bulletin; the modem patch and kernel protections are part of the Foundation OS.