Katana

A BootROM exploit for Qualcomm devices released within 2016 til 2019.

Brief Explanation of the Exploit

With the MSM8998 (Nazgul) SoC, the command 0x13 (SAHARA_RESET_STATE_MACHINE_ID) was added. The command called into boot_sahara_entry, which is supposed to reinitialize Sahara. The flaw is that each call into it decreases the stack pointer by 0x60 and there is no stack guard. With enough calls, we exhaust the available stack space (0x3000), corrupt memory beyond the stack and make stack buffers overlap with some of the global function pointer tables. secboot_verify_cert_signature will read the modulus and signature in BIGINT format into stack buffers. Since crypto_ftbl->ModExp was overwritten by the buffers, secmath_BIGINT_modexp will jump into our shellcode from the modulus. However, it seems that where I reverse engineered this exploit from, uses a different way to land their shellcode.

More can be found at HEXACON2023 - Bug Tales : Life and Death in the Sahara

Known vulnerable SoCs

Caution

Even if the SoC is vulnerable, it does not mean that you can exploit it! If your SoC is listed here, do NOT store any secrets on a device with it. Cellebrite, MSAB and Oxygen Forensics are able to decrypt the user data on Devices with such SoCs, thanks to this CVE.

Usage

usage: katana.py [-h] -s SOC -e EXPLOIT [-f FIREHOSE] [-v] [-pid PID] [-vid VID]

A PoC for the CVE-2021-30327 vulnerability in Qualcomm Sahara

options:
  -h, --help            show this help message and exit
  -s, --soc SOC         SoC model
  -e, --exploit EXPLOIT
                        Exploit PBL (CVE-2021-30327) with a payload
  -f, --firehose FIREHOSE
                        DevPrg image in case the payload reinitializes Sahara
  -v, --verbose         Enable to view TX/RX Sahara logs
  -pid PID              Override USB PID (default 0x9008)
  -vid VID              Override USB VID (default 0x05C6)

To check if your SoC is actually exploitable, please use check_vuln.py.

usage: check_vuln.py [-h] [-v] [-pid PID] [-vid VID]

A PoC for the CVE-2021-30327 vulnerability in Qualcomm Sahara

options:
  -h, --help     show this help message and exit
  -v, --verbose  Enable to view TX/RX Sahara logs
  -pid PID       Override USB PID (default 0x9008)
  -vid VID       Override USB VID (default 0x05C6)

Credits

• CVE-2021-30327 This is the CVE which Katana exploits
• Iskuri (Christopher Wade) Reported CVE-2021-30327 to Qualcomm
• Seamus Burke & Aaron Willey - First people who exploited this CVE, showcased it at HEXACON2023
• R0rt1z2 Helped with sniffing this exploit
• kethily-daniel Gave me a tool which was exploiting this exact Vulnerability
• halal-beef Script base