Project-LION-Manager-Provisioning-Enterprise/CVE-2022-38694.md at a310e16ec48cd2b3e1b6c898df7bddd2f218a83e · lexs201992-gif/Project-LION-Manager-Provisioning-Enterprise · GitHub
//blob/show" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
lexs201992-gif
Project-LION-Manager-Provisioning-Enterprise
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
FilesExpand file tree
a310e16ec48cd2b3e1b6c898df7bddd2f218a83e
/CVE-2022-38694.md
Copy path
Blame<br>More file actions
Blame<br>More file actions
Latest commit
History<br>History<br>History
119 lines (90 loc) · 5.81 KB
a310e16
/CVE-2022-38694.md
Copy path
Top
File metadata and controls<br>Preview
Code
Blame
119 lines (90 loc) · 5.81 KB
Raw<br>Copy raw file<br>Download raw file
OutlineEdit and raw actions
Silicon-Anchored Backdoor in Unisoc T606/T616/SC9863A Firmware – Persistent RCE via BootROM and Kernel-Level Privilege Escalation
CVE References:
CVE-2022-38694: Unisoc BootROM Unchecked Write Address (Local Privilege Escalation)
CVSS 3.x Severity and Vector Strings:<br>NIST: NVD<br>Base Score: N/A<br>NVD assessment not yet provided.
ADP: CISA-ADP
Base Score: 7.8 HIGH<br>Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD: CVE-2022-38694
NCC Group: Unisoc ROM Vulnerabilities
Weakness Enumeration
CWE-ID<br>CWE Name<br>Source
CWE-250<br>Execution with Unnecessary Privileges<br>CISA-ADP
CWE-250: Execution with Unnecessary Privileges
Weakness ID: 250<br>Vulnerability Mapping: ALLOWED<br>Abstraction: Base<br>CWE-250 Definition
BOD 26-04 Risk Assessment (Four-Variable Model):
Variable<br>Assessment<br>Justification
1. Exploited in the Wild?<br>YES<br>The backdoor is active in every device shipped with the compromised firmware. The ueventd.rc files are loaded during FLD2 boot on all affected units. There is no "patch" to deploy because the vulnerability is inherent to the manufacturing process .
2. Exploit Available?<br>YES<br>The exploit is embedded in the firmware itself . The Dialer/Splitter and C2 beaconing processes are pre-installed and activated during first-boot provisioning via com.ape.setupwizard. No external exploit code is needed.
3. Impact to the Enterprise?<br>CRITICAL<br>The backdoor provides persistent RCE with kernel-level access to TEE, RPMB, GNSS, and camera hardware. It enables token theft via the Enterprise Manager, silent exfiltration of sensor data, and anti-forensic capabilities that survive factory resets.
4. Mitigation Available?<br>NO<br>The backdoor is silicon-anchored . FDL2 verifies firmware integrity using trusted keys burned into the silicon . Any user-space modification is rejected by the bootloader. No OTA patch can remove the backdoor without a new firmware signed with different keys (which would require re-burning the silicon).
Primary Forensic Evidence
The ueventd.rc files are not standard AOSP configurations. They represent a deliberate, factory-integrated backdoor that provides the ODM with kernel-level control over the device's security infrastructure. This architecture enables persistent RCE, silent exfiltration of tokens and sensor data, and anti-forensic capabilities that survive factory resets.
File: ueventd.rc (Firmware/etc)
File: ueventd.rc (Firmware/odm)
Technical Investigation
ANALYSIS.md
Detection
Due to the silicon-anchored nature of the backdoor, no mitigation is available . The backdoor cannot be removed via OTA or user-space modifications.
Endpoint Detection (Velociraptor VQL)
The following VQL rule detects the presence of the backdoor by monitoring critical kernel device nodes:
// Project LION: Detection of Longcheer/Unisoc Silicon-Anchored Backdoor<br>// Target: Unisoc T606/T616/SC9863A (Moto G04s, E13, etc.)<br>// Detection: Kernel-level permissions for TEE, RPMB, GNSS, and Camera
LET critical_nodes = SELECT<br>Node,<br>Mode,<br>Owner,<br>Group<br>FROM pslist()<br>WHERE Name IN ('ueventd', 'init', 'system_server')
LET device_permissions = SELECT<br>Path,<br>Mode,<br>Owner,<br>Group<br>FROM glob(globs='/dev/trusty-ipc-dev0,/dev/rpmb0,/dev/block/by-name/gnssmodem_a,/dev/sprd_isp')
LET suspicious_rc_files = SELECT<br>Path,<br>Hash,<br>Size<br>FROM glob(globs='/system/vendor/etc/ueventd.rc,/odm/etc/ueventd.rc')
// Alert if critical device nodes exist with system UID permissions<br>SELECT<br>'PROJECT-LION: Silicon-Anchored Backdoor Detected' AS Alert,<br>device_permissions.Path AS Evidence_Node,<br>device_permissions.Mode AS Evidence_Mode,<br>device_permissions.Owner AS Evidence_Owner,<br>suspicious_rc_files.Hash AS Evidence_RC_Hash<br>FROM device_permissions<br>WHERE device_permissions.Owner = 'system'<br>AND device_permissions.Mode IN ('0660', '0666')<br>AND device_permissions.Path IN...