Lifting the (Hyper) Visor: Bypassing Samsung’s Real-Time Kernel Protection

This blog post discusses a bug leading to memory corruption in Samsung's Android kernel (specifically the kernel of the Galaxy A50, A505FN - I haven't looked at Samsung's kernels for other devices). I will describe the bug and how I wrote a (very unreliable) exploit for it. I will also describe how a second vulnerability, which had long been fixed in the upstream kernel, the upstream stable releases, and the Android common kernel, but not in Samsung's kernel, aided in its exploitation.

Project Zero researched the Samsung Galaxy S6 Edge and reported 11 high-impact security issues, discussing motivations, methodology and lessons learned from the device research.

Disclosure of multiple internet-to-baseband remote code execution vulnerabilities affecting Samsung Exynos modems, detailing the flaws, affected devices, and patch availability.

A Google Project Zero post exploiting a bug in NVIDIA's NVMAP driver (CVE-2014-5332) to escape the Chrome for Android sandbox.

A Google Project Zero post detailing a bypass of Windows' Administrator Protection feature through abuse of UI Access, one of nine bypasses found and fixed.

A Google Project Zero analysis of Windows 11 25H2's Administrator Protection feature, which replaces UAC, and methods for bypassing it.