Google Android - RKP EL1 Code Loading Bypass

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=981 As part of Samsung KNOX, Samsung phones include a security hypervisor called RKP Real-time Kernel Protection, running in EL2. This hypervisor is meant to ensure that the HLOS kernel running in EL1 remains protected from exploit...

Google Android - Unprotected MSRs in EL1 RKP Privilege Escalation

Google Android - Unprotected MSRs in EL1 RKP Privilege Escalation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=980 As part of Samsung KNOX, Samsung phones include a security hypervisor called RKP Real-time Kernel Protection, running in EL2. This hypervisor is meant to ensure...

Google Android - cfp_ropp_new_key_reenc and cfp_ropp_new_key RKP Memory Corruption Exploit

Exploit for Android platform in category dos / poc Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=979 As part of Samsung KNOX, Samsung phones include a security hypervisor called RKP Real-time Kernel Protection, running in EL2. This hypervisor is meant to ensure that the HLOS...

CVE-2016-1919

Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack...

CVE-2016-3996

ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application...

CVE-2016-1920

Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certificate and running a VPN service...

Code injection

Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack...

Code injection

ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application...

CVE-2016-1919

Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack...

CVE-2016-1920

Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certificate and running a VPN service...

CVE-2016-3996

ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application...

Code injection

Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certificate and running a VPN service...

CVE-2016-1920

Samsung KNOX 1.0.0 uses the shared certificate on Android, which allows local users to conduct man-in-the-middle attacks as demonstrated by installing a certificate and running a VPN service...

CVE-2016-1919

Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack...

CVE-2016-1919

The CVE-2016-1919 entry concerns Samsung KNOX 1.0 on Android 4.3 where the eCryptFS key is derived from the user password and a TIMA key. The weakness lies in the eCryptFS-key generation algorithm, enabling potential disclosure of Data-at-Rest from KNOX containers when an attacker has local acces...

CVE-2016-3996

The CVE-2016-3996 issue affects Samsung KNOX 1.0.0 and 2.3.0 where ClipboardDataMgr does not properly validate the caller, allowing local users to read KNOX clipboard data via a crafted application. The NVD entry and related materials describe a local-access disclosure without specifying remote e...

CVE-2016-3996

ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application...

CVE-2016-1920

CVE-2016-1920 : Concrete details exist. Samsung KNOX 1.0.0 on Android uses a shared certificate, enabling local users to perform man-in-the-middle (MITM) attacks by installing a certificate and running a VPN service. Root cause is the use of a shared/untrusted certificate within KNOX. Impact is l...

CVE-2016-3996: Exposure of Sensitive Information to an Unauthorized Actor

ClipboardDataMgr in Samsung KNOX 1.0.0 and 2.3.0 does not properly check the caller, which allows local users to read KNOX clipboard data via a crafted application...

CVE-2016-1919: Exposure of Sensitive Information to an Unauthorized Actor

Samsung KNOX 1.0 uses a weak eCryptFS Key generation algorithm, which makes it easier for local users to obtain sensitive information by leveraging knowledge of the TIMA key and a brute-force attack...