Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access
SSD Secure Disclosure published a two-stage exploit chain achieving full Android kernel access via VoLTE video calls on Unisoc modem firmware, with no vendor response or fix The privilege-escalation vulnerability (CWE-1189) stems from improper isolation of shared physical memory between the modem and application processors in Unisoc SoCs, allowing modem-context code to modify kernel memory The attack chain requires an attacker-controlled private 4G network, a malformed SIP video call triggering
Analysis
TL;DR
- SSD Secure Disclosure published a two-stage exploit chain achieving full Android kernel access via VoLTE video calls on Unisoc modem firmware, with no vendor response or fix
- The privilege-escalation vulnerability (CWE-1189) stems from improper isolation of shared physical memory between the modem and application processors in Unisoc SoCs, allowing modem-context code to modify kernel memory
- The attack chain requires an attacker-controlled private 4G network, a malformed SIP video call triggering initial RCE (March 2026 disclosure), and the victim answering the call to complete privilege escalation
- Affected chipsets include the T606 (Motorola E13), T612 (Realme C33), and T7250 (Xiaomi Redmi A5), with no patches available as of the August 2026 disclosure
- This follows a November 2025 Kaspersky ICS CERT finding of the same architectural flaw on the UIS7862A chipset in vehicle head units, indicating a systemic Unisoc design issue
Why It Matters
This exploit chain demonstrates how a fundamental SoC-level architectural weakness—shared physical memory without hardware-enforced boundaries between modem and application processors—can be weaponized into full kernel compromise through a socially engineered vector (answering a video call). For AI practitioners and security researchers, it underscores the critical importance of hardware trust boundaries in mobile platforms and the real-world impact of unpatched modem firmware vulnerabilities on end-user device security.
Technical Details
- Two-stage exploit chain: Stage 1 (March 2026) achieves remote code execution on Unisoc modem firmware via a malformed SIP video call; Stage 2 (August 2026) escalates privileges by writing a full-access configuration to the modem's ARM Memory Protection Unit through coprocessor registers, mapping the entire 32-bit physical address space as readable, writable, and executable from modem context
- Root cause (CWE-1189): The Unisoc SoC architecture shares physical memory between the modem processor and application processor with no hardware-enforced boundary, allowing modem-context code to directly read and write Android kernel pages
- Proof-of-concept environment: Built using an open-source 4G core network, a software-defined radio for the 4G radio interface, and specialized SIM cards to simulate attacker-controlled VoLTE infrastructure
- Affected devices confirmed: Motorola E13 (February 2025 security patch) and Xiaomi Redmi A5 (January 2026 patch); the flaw is shared across at least three Unisoc chipsets (T606, T612, T7250)
- Related prior research: Kaspersky ICS CERT (November 2025) documented the same shared-memory architectural condition on the UIS7862A chipset in vehicle head units, with one lateral movement path involving a hidden DMA peripheral described as a hardware-level issue unfixable via software
Industry Insight
- Chipmakers must treat modem-application processor isolation as a first-class security requirement; shared-memory SoC designs without hardware-enforced boundaries represent a systemic risk that can cascade into full device compromise through telecom-layer attacks
- Device manufacturers relying on Unisoc chipsets should proactively pressure the vendor for firmware updates and consider mitigations such as disabling VoLTE video call handling or enforcing strict modem firmware integrity checks until patches are available
- The pattern of repeated architectural vulnerabilities across Unisoc chip families (mobile and automotive) suggests a need for independent hardware security audits at the SoC design level, rather than relying solely on vendor-driven vulnerability disclosures and patch cycles
Disclaimer: The above content is generated by AI and is for reference only.