Bad io_uring: A New Era of Rooting for Android

io_uring is a high-performance asynchronous I/O framework that was introduced in version 5.1 of the Linux kernel. Since its introduction, more than 100 vulnerabilities have been discovered in this subsystem. While there is extensive public exploitation against io_uring bugs in desktop Linux, no public research has targeted it in the Android kernel due to its strict restrictions on memory layout manipulation.

During this talk, we will detail our approach to achieving privilege escalation on Google Pixel 6 and Samsung S22 …

android asynchronous bad bugs desktop exploitation framework high introduction io_uring kernel linux linux kernel performance public research subsystem version vulnerabilities