New Unisoc modem flaw allows Android kernel access

As reported by Dark Reading, researchers at SSD Secure Disclosure have uncovered a critical vulnerability in Unisoc T612 modem firmware that, when combined with a prior remote code execution (RCE) flaw, could grant attackers privileged access to the Android kernel on affected devices.

The attack requires a two-stage process. First, an attacker exploits a previously known RCE vulnerability to deliver a malicious payload to the phone's modem. Subsequently, the attacker initiates a video call to the target device. If the victim answers the call, the exploit is completed. This triggers a newly discovered memory-isolation weakness in the Unisoc T612 modem's firmware, allowing the attacker to escalate privileges and gain kernel-level access on the Android device.

Researchers demonstrated this exploit chain on a Realme C33 smartphone, confirming its effectiveness on devices with specific Android security patches. Unisoc chipsets are used by multiple mobile manufacturers, including Motorola, Samsung, and Nokia, raising concerns about the potential widespread impact of this vulnerability. This discovery highlights cellular modems as a significant and often remotely accessible attack surface for threat actors.

Source: Dark Reading