CVE-2023-49794

Executive Summary

CVE-2023-49794 is a critical privilege escalation vulnerability in KernelSU, a Kernel-based root solution for Android devices. The flaw resides in the kernel module's logic for verifying the APK path of the KernelSU Manager application. An attacker can bypass this verification by installing a malicious application with the package name me.weishu.kernelsu, thereby gaining root privileges on the device. This vulnerability affects KernelSU versions 0.7.1 and prior. As of the time of this report, no official patch is available, leaving devices with KernelSU installed at high risk of complete compromise.

Supply Chain & Package Security

KernelSU is distributed as a kernel module and is not managed through standard package registries like NPM, PyPI, Go, or Ruby. The risk is primarily to the Android device supply chain, where a malicious app with the same package name as the legitimate KernelSU Manager can be installed, leading to root-level access. This highlights a critical gap in Android's package management and permission models when combined with kernel-level root solutions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.7 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have the ability to install an APK on the device.
• Attack Complexity: Low (AC:L) – No special conditions are required beyond installing a malicious app.
• Privileges Required: Low (PR:L) – The attacker needs user-level access to install apps.
• User Interaction: None (UI:N) – No user action is needed beyond the initial installation.
• Scope: Unchanged (S:U) – The vulnerability does not cross security boundaries.
• Confidentiality Impact: High (C:H) – Root access allows reading all data.
• Integrity Impact: High (I:H) – Root access allows modifying system files.
• Availability Impact: High (A:H) – Root access can be used to brick the device.

Threat Level: Critical in the context of Android devices with KernelSU installed. The low attack complexity and high impact make it a prime target for malware and rootkit developers.

Deep Dive & Mechanics

KernelSU is a kernel module that provides root access to Android devices. It uses a companion app (the KernelSU Manager) to manage root permissions. The vulnerability lies in the kernel module's function that retrieves the APK path of the KernelSU Manager. The logic is flawed, allowing any APK with the package name me.weishu.kernelsu to be recognized as the legitimate manager.

Root Cause: The kernel module does not properly validate the APK's signature or origin. It only checks the package name. This allows an attacker to create a malicious APK with the same package name, which, when installed, will be granted root privileges by the kernel module.

Attack Flow:

1. The attacker creates a malicious APK with the package name me.weishu.kernelsu.
2. The attacker installs this APK on a device that has KernelSU installed (version 0.7.1 or prior).
3. The KernelSU kernel module, when checking for the manager app, finds the malicious APK and grants it root privileges.
4. The malicious app can now execute arbitrary commands with root access, including installing backdoors, stealing data, or bricking the device.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is the only reference. The fix would require the kernel module to verify the APK's signature against a known good certificate, not just the package name.

Vulnerable Code (Conceptual):

// KernelSU kernel module - vulnerable get_apk_path function
char* get_apk_path() {
    // This function only checks the package name
    // It does not verify the APK's signature
    if (apk_package_name == "me.weishu.kernelsu") {
        return apk_path;
    }
    return NULL;
}

Patched Code (Conceptual):

// KernelSU kernel module - patched get_apk_path function
char* get_apk_path() {
    // Verify both package name and signature
    if (apk_package_name == "me.weishu.kernelsu" && verify_apk_signature(apk_path, KNOWN_GOOD_CERT)) {
        return apk_path;
    }
    return NULL;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• An Android device with KernelSU version 0.7.1 or prior installed.
• Ability to install APKs (USB debugging enabled or sideloading allowed).

Steps:

1. Create a malicious APK with the package name me.weishu.kernelsu. This can be done by modifying the AndroidManifest.xml of any app.
2. Install the malicious APK on the target device.
3. The KernelSU kernel module will automatically grant root privileges to the malicious app.
4. Execute root commands from the malicious app.

Example Malicious APK Code (Conceptual):

// Malicious app with package name me.weishu.kernelsu
public class MainActivity extends Activity {
    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        // This app will be granted root by KernelSU
        // Execute a root command
        try {
            Process process = Runtime.getRuntime().exec("su -c 'id'");
            // Read output
        } catch (IOException e) {
            e.printStackTrace();
        }
    }
}

Blue Team (Defense)

Detection:

• Monitor for installation of apps with the package name me.weishu.kernelsu that are not the official KernelSU Manager.
• Use Android's PackageManager to check the installer package name and signature.
• Implement kernel-level checks to verify the APK's signature before granting root.

Prevention:

• Update KernelSU to a patched version when available.
• Disable installation of apps from unknown sources.
• Use Android's signature verification to ensure only the official KernelSU Manager is trusted.

Indicators of Compromise (IOCs)

• Package Name: me.weishu.kernelsu (any app with this package name that is not the official KernelSU Manager)
• File Hashes: (To be generated based on known malicious samples)
• Network Traffic: Unusual outbound connections from the device after the malicious app is installed.
• Processes: Processes running with root privileges that are not expected (e.g., a user-installed app running as root).

Detection Engineering

YARA Rule

rule CVE_2023_49794_KernelSU_Bypass {
    meta:
        description = "Detects malicious APKs exploiting CVE-2023-49794"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-49794"
    strings:
        $package_name = "me.weishu.kernelsu"
        $root_command = "su -c"
    condition:
        $package_name and $root_command
}

Sigma Rule

title: CVE-2023-49794 - KernelSU APK Path Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects installation of apps with package name me.weishu.kernelsu that are not the official KernelSU Manager
author: Valters IT
date: 2024-01-01
logsource:
    product: android
    service: package_installer
detection:
    selection:
        package_name: "me.weishu.kernelsu"
        installer_package: "*"
    condition: selection
falsepositives:
    - Official KernelSU Manager installation
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2023-49794 - KernelSU Malicious APK Communication"; flow:to_server; content:"me.weishu.kernelsu"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable KernelSU: If possible, uninstall KernelSU from affected devices until a patch is available.
2. Restrict App Installation: Disable installation of apps from unknown sources on devices with KernelSU.
3. Monitor for Malicious Apps: Use MDM solutions to detect and block apps with the package name me.weishu.kernelsu that are not the official KernelSU Manager.

Long-term Fix:

• The KernelSU developers must release a patched version that verifies the APK's signature before granting root privileges.
• Users should update to the latest version of KernelSU as soon as a patch is available.

Workaround:

• Implement a kernel-level hook that checks the APK's signature against a known good certificate before granting root.

Valters IT
Securing Digital Frontiers