The Android permission management system has already suffered from several vulnerabilities in the past. Such weaknesses can grant dangerous permissions to a malevolent application, an example being CALL_LOG, which gives access to all incoming and outgoing calls.

This post dives into the Android permission system and how a solver was leveraged to find new vulnerabilities. With this approach, a privilege escalation was identified, which was fixed and assigned CVE-2023-20947 by Google.

1. Discovery of two vulnerabilities in secure world components
2. Exploitation to get code execution in a trusted driver, while not having a debugger for this obscure environment
3. Leverage of aarch32 T32 instruction set to find nice stack pivots
4. Turning an arbitrary write into an arbitrary code execution