EmbeddingGemma 2: an open, lightweight multimodal embedding model
deepmind.google·6d ago
AI Engineering
Hacker News·28d ago·5 min read
OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others
TL;DR
A new exploitation strategy allows unprivileged Android apps to gain root access on Samsung, Xiaomi, and other devices, showcasing a unified approach to a complex problem.
✦ Why It Matters
Review your app's security measures to prevent potential privilege escalation vulnerabilities.
Key Takeaways
- Investigate OEM-specific vulnerabilities in your Android applications.
- Implement security measures against page UAF exploits.
- Regularly update and patch Android devices to minimize risks.
- Monitor for unusual behavior indicative of privilege escalation attempts.
How It Works
The strategy exploits a page UAF in OEM kernel drivers by first using a logic flaw in OEM IPC to escape the untrusted_app sandbox. This allows access to the vulnerable driver, where the UAF can be leveraged to gain control over physical memory pages, bypassing typical security measures.