A new kernel exploit has been discovered to obtain root on Exynos devices. The good news is we can now obtain root privileges very easy on these devices, the bad news is any app (including Google Play apps) can obtain root without the user knowing, these apps can also perform ram dumps, kernel code injection and exploitation with native C or Java is also possible.

Devices effected:

• Samsung Galaxy S2
• Samsung Galaxy S3
• Samsung Galaxy Note
• Samsung Galaxy Note 2
• MEIZU MX
• Potentially any device with Exynos processor (4210 and 4412) that uses Samsungs kernel sources.

How do we stop this ?

Luckily respected developer Chainfire has created an app called “ExynosAbuse” to work around this security hole, here is a quote from his XDA post:

At the moment, Supercurio’s method relies on Android starting it at boot, using the same method any Android app uses to launch at boot. There is no guaranteed order of these apps being launched, and as such, a malicious app could be executing malicious code before the exploit is disabled.

RyanZA’s method relies on the same mechanism as well and as such is still vulnerable. Furthermore, unlike Supercurio’s and my own patch, RyanZA’s patch chmod’s to 0600 while ours chmod to 0400 or 0000. With 0600, system user can still run the exploit, so chaining a half-exploit that only gives system user followed by ExynosAbuse may still grant an attacker root access.

My method requires proper root and modifies /system, and disabling the exploit is done before any normal Android app (like those installed from the Play store) have a chance to execute their code. As long as you tell my app to disable the exploit at boot before you install a malicious app, and providing you do not grant a malicious app root (through SuperSU), this should protect against any exploit. Also note that after enabling applying the patch at boot, you can unroot in SuperSU again (SuperSU –> Settings –> Full Unroot) and the patch will keep working, but you’ll be unrooted again (if you don’t want root). On some devices it takes a reboot for SuperSU to truly disappear after that, by the way.

With my patch, I do advise testing the exploit was disabled after a reboot by running ExynosAbuse again, and verifying both checkboxes next to “Disable exploit” and “Disable exploit on boot” are enabled. These auto-detect the current state, and if the patch on boot was succesful both will be checked.

The only problem with this app is if you disable the exploit it may break the camera.

More information about the Exynos exploit

Chainfires XDA post with app