Google Pixel phones are too easy for hackers – post compromise – to further exploit, according to Google’s own Project Zero. The issue, according to a Google, is tied to a key Android defense meant to protect the communications bridge between a phone’s hardware and OS (called a kernel) from being exploited.
In a Monday post by Google’s own Project Zero researcher Seth Jenkins said Pixel devices running the ARM64 Linux kernel no longer have an important security tied to a feature called Kernel Address Space Layout Randomization (KASLR). This feature is meant to make it harder for attackers to locate and manipulate critical system memory.
The end result could be increased Kernal attacks on post-compromised devices. Attack scenarios range from privilege escalation, arbitrary code execution, and allowing a hacker persistent and stealthy device surveillance.
It’s Not a Bug: It’s a Feature
Jenkins stressed his discovery is not a bug, but rather a design decision that weakens KASLR. He added there are no reports that KASLR is being abused in the wild and also that the his research can’t be used by an adversary for remote compromise of a device. Rather the KASLR design makes it easier for an attacker who already has a foothold on a targeted device much easier to further exploit it.
In simple terms, Jenkins argues what should be random is now predictable.
“On Pixel phones, the bootloader decompresses the kernel itself at the same physical address every boot… In short, instead of breaking the KASLR slide, it is possible to just use 0xffffff8000010000 as a kernel base instead,” Jenkins wrote.
Simply stated, because the kernel loads at the same physical and virtual addresses on every boot, attackers can now calculate memory locations in advance, bypassing KASLR’s randomized memory feature.
Affected are nearly all Pixel models from the Pixel 3 through the Pixel 9 series that run on ARM64 Linux kernels. The same non-randomized memory behavior may also impact other Android handset makers running the same ARM64 Linux kernels. However Samsung and some other vendors have chosen to implemented randomization, giving their devices a stronger defense against kernel-level attacks.
Design Decisions Matter
According to Jenkins, the weakness stems from two kernel design choices: the Linux kernel’s lack of linear map randomization on ARM64, and Pixel’s bootloader behavior of decompressing the kernel to the same physical address on every boot. The combined effect, he wrote, “dramatically simplified what might otherwise have been a more complicated and likely less reliable exploit.”
According to the post, Linux kernel developers (with input from ARM engineers) decided to drop linear map randomization for ARM64 kernels. And Google’s Android and Pixel teams chose not to compensate by adding new randomization in their bootloader or kernel configuration.
The two separate issues – lack of linear map randomization and the fact that the kernel lands at static physical addresses in Pixel – were both reported to the Linux kernel team and Google Pixel team, Jenkins said. “However, both of these issues are considered intended behavior.”
Earlier versions of the ARM64 Linux kernel included randomization features now removed from Android’s build, Jenkins wrote. This was a design shift that traded maintainability for security, he said. Consequently, this left Pixel devices far more predictable in memory layout than before.
“Randomizing the location of the linear map in the virtual address space, increasing the entropy in physical page allocation, and randomizing the location of the kernel in the physical address space are all concrete steps that can be taken that would improve the overall security posture of Android, the Linux kernel, and Pixel,” he said.
“The joint effect of these two issues dramatically simplified what might otherwise have been a more complicated and likely less reliable exploit,” he wrote.
Unless Google reintroduces kernel randomization or compensates at the bootloader level, Pixel devices will remain far easier to compromise locally than competing Android phones.
