Persistent RCE via BootROM and Kernel

lexs201992-gif1 pts0 comments

Project-LION-Manager-Provisioning-Enterprise/CVE-2022-38694.md at a310e16ec48cd2b3e1b6c898df7bddd2f218a83e · lexs201992-gif/Project-LION-Manager-Provisioning-Enterprise · GitHub

//blob/show" data-turbo-transient="true" />

Skip to content

Search/

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

lexs201992-gif

Project-LION-Manager-Provisioning-Enterprise

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

FilesExpand file tree

a310e16ec48cd2b3e1b6c898df7bddd2f218a83e

/CVE-2022-38694.md

Copy path

Blame<br>More file actions

Blame<br>More file actions

Latest commit

History<br>History<br>History

119 lines (90 loc) · 5.81 KB

a310e16

/CVE-2022-38694.md

Copy path

Top

File metadata and controls<br>Preview

Code

Blame

119 lines (90 loc) · 5.81 KB

Raw<br>Copy raw file<br>Download raw file

OutlineEdit and raw actions

Silicon-Anchored Backdoor in Unisoc T606/T616/SC9863A Firmware – Persistent RCE via BootROM and Kernel-Level Privilege Escalation

CVE References:

CVE-2022-38694: Unisoc BootROM Unchecked Write Address (Local Privilege Escalation)

CVSS 3.x Severity and Vector Strings:<br>NIST: NVD<br>Base Score: N/A<br>NVD assessment not yet provided.

ADP: CISA-ADP

Base Score: 7.8 HIGH<br>Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD: CVE-2022-38694

NCC Group: Unisoc ROM Vulnerabilities

Weakness Enumeration

CWE-ID<br>CWE Name<br>Source

CWE-250<br>Execution with Unnecessary Privileges<br>CISA-ADP

CWE-250: Execution with Unnecessary Privileges

Weakness ID: 250<br>Vulnerability Mapping: ALLOWED<br>Abstraction: Base<br>CWE-250 Definition

BOD 26-04 Risk Assessment (Four-Variable Model):

Variable<br>Assessment<br>Justification

1. Exploited in the Wild?<br>YES<br>The backdoor is active in every device shipped with the compromised firmware. The ueventd.rc files are loaded during FLD2 boot on all affected units. There is no "patch" to deploy because the vulnerability is inherent to the manufacturing process .

2. Exploit Available?<br>YES<br>The exploit is embedded in the firmware itself . The Dialer/Splitter and C2 beaconing processes are pre-installed and activated during first-boot provisioning via com.ape.setupwizard. No external exploit code is needed.

3. Impact to the Enterprise?<br>CRITICAL<br>The backdoor provides persistent RCE with kernel-level access to TEE, RPMB, GNSS, and camera hardware. It enables token theft via the Enterprise Manager, silent exfiltration of sensor data, and anti-forensic capabilities that survive factory resets.

4. Mitigation Available?<br>NO<br>The backdoor is silicon-anchored . FDL2 verifies firmware integrity using trusted keys burned into the silicon . Any user-space modification is rejected by the bootloader. No OTA patch can remove the backdoor without a new firmware signed with different keys (which would require re-burning the silicon).

Primary Forensic Evidence

The ueventd.rc files are not standard AOSP configurations. They represent a deliberate, factory-integrated backdoor that provides the ODM with kernel-level control over the device's security infrastructure. This architecture enables persistent RCE, silent exfiltration of tokens and sensor data, and anti-forensic capabilities that survive factory resets.

File: ueventd.rc (Firmware/etc)

File: ueventd.rc (Firmware/odm)

Technical Investigation

ANALYSIS.md

Detection

Due to the silicon-anchored nature of the backdoor, no mitigation is available . The backdoor cannot be removed via OTA or user-space modifications.

Endpoint Detection (Velociraptor VQL)

The following VQL rule detects the presence of the backdoor by monitoring critical kernel device nodes:

// Project LION: Detection of Longcheer/Unisoc Silicon-Anchored Backdoor<br>// Target: Unisoc T606/T616/SC9863A (Moto G04s, E13, etc.)<br>// Detection: Kernel-level permissions for TEE, RPMB, GNSS, and Camera

LET critical_nodes = SELECT<br>Node,<br>Mode,<br>Owner,<br>Group<br>FROM pslist()<br>WHERE Name IN ('ueventd', 'init', 'system_server')

LET device_permissions = SELECT<br>Path,<br>Mode,<br>Owner,<br>Group<br>FROM glob(globs='/dev/trusty-ipc-dev0,/dev/rpmb0,/dev/block/by-name/gnssmodem_a,/dev/sprd_isp')

LET suspicious_rc_files = SELECT<br>Path,<br>Hash,<br>Size<br>FROM glob(globs='/system/vendor/etc/ueventd.rc,/odm/etc/ueventd.rc')

// Alert if critical device nodes exist with system UID permissions<br>SELECT<br>'PROJECT-LION: Silicon-Anchored Backdoor Detected' AS Alert,<br>device_permissions.Path AS Evidence_Node,<br>device_permissions.Mode AS Evidence_Mode,<br>device_permissions.Owner AS Evidence_Owner,<br>suspicious_rc_files.Hash AS Evidence_RC_Hash<br>FROM device_permissions<br>WHERE device_permissions.Owner = 'system'<br>AND device_permissions.Mode IN ('0660', '0666')<br>AND device_permissions.Path IN...

backdoor file device_permissions silicon firmware ueventd

Related Articles