Summary
- SSD Secure Disclosure demonstrated a two-stage path from VoLTE modem code execution to Android kernel control.
- The full proof of concept requires attacker-controlled cellular infrastructure and the target answering a video call.
- Researchers report no vendor fix for the second-stage isolation weakness at publication.
Security researchers have demonstrated an exploit chain that crosses from cellular modem firmware into the Android kernel on phones using several UNISOC chipsets, exposing a hardware trust boundary that ordinary Android application controls do not govern.
UNISOC chipsets including the T606, T612, and T7250 are affected by the research published through SSD Secure Disclosure. The chain combines a previously disclosed modem remote-code-execution vulnerability with a newly described privilege-escalation technique that allows modem-context code to modify memory used by Android.
The proof of concept is technically serious but operationally constrained. Researchers required control of private 4G infrastructure, including their own cellular core and radio environment, and the target user had to answer an incoming VoLTE video call.
That is materially different from an internet-wide remote exploit requiring only a phone number.
The first stage was disclosed in March. SSD found that malformed Session Description Protocol data handled by UNISOC modem firmware could trigger memory corruption during a VoLTE video call and lead to native code execution in the modem.
The new work examines what can happen after that foothold has been obtained. Researchers found that the modem processor and Android application processor shared physical memory without a hardware-enforced boundary preventing modem-context code from writing into regions containing the Android kernel.
By changing the modem’s ARM Memory Protection Unit configuration, the researchers made the broader physical address space readable, writable, and executable from modem context. They then demonstrated code running at Android kernel level.
The significance of that transition is architectural. Modern smartphones deliberately separate radio/baseband processing from the general-purpose operating system because the modem handles complex and largely untrusted network input. If code executing inside the baseband can modify kernel memory belonging to Android, compromise can move across a security boundary that is supposed to limit the consequence of a modem flaw.
The researchers reproduced the condition on devices including a Motorola E13 and Xiaomi Redmi A5. The earlier modem issue was also tested on a Realme C33, and SSD lists several affected UNISOC chipset families.
UNISOC had not provided SSD with a response through the channels the researchers said they used for disclosure, and the August Android security bulletin did not contain a fix for the newly disclosed privilege-escalation issue at publication.
The vulnerability therefore also illustrates the fragmented patch chain surrounding mobile silicon. A chipset flaw may need to move from semiconductor vendor to handset manufacturer and then through device-specific firmware release processes before it reaches deployed phones.
That differs from a conventional Android application vulnerability where Google or an application vendor can often distribute a repair through a more centralised mechanism.
The researchers’ use of controlled cellular infrastructure limits immediate exploitation risk, but it does not eliminate the importance of the isolation failure. Telecommunications networks are part of the attacker model for baseband security precisely because phones process radio signalling before the user reaches the operating system’s normal security controls.
Previous research on other UNISOC silicon has also examined how modem compromise can interact with shared system memory, suggesting that the newly demonstrated chain is part of a broader architectural question rather than an isolated parser defect.
For affected devices, the next practical development will be whether UNISOC acknowledges the second-stage weakness and how quickly firmware updates propagate through manufacturers. Until that happens, researchers have demonstrated that compromise of the cellular processor can, under the conditions tested, become compromise of Android’s kernel itself.
