Baseband-to-Kernel Breach: Unisoc VoLTE Video Call Exploit Chain Manipulates Android Kernel Memory
Executive Summary
Security researchers have uncovered a critical vulnerability chain affecting Unisoc baseband modems and System-on-Chip (SoC) architectures—specifically chipsets T606, T612, and T7250—which power hundreds of millions of budget and mid-range Android smartphones globally (The Hacker News, Check Point Research).
The zero-interaction, over-the-air (OTA) exploit chain allows a remote attacker to trigger memory corruption in the cellular modem firmware via a VoLTE video call, escape baseband isolation, and directly read and write to the Android Linux kernel memory space (kptr / physical RAM). This sequence enables unauthenticated root device takeover without requiring any user interaction.
Deep-Dive Technical Analysis
Attack Vector & IMS Video Codec Parsing
Voice over LTE (VoLTE) and Video over LTE (ViLTE) rely on the IP Multimedia Subsystem (IMS) network architecture to transmit real-time audio and video packets (RTP/RTCP). When an incoming VoLTE video call is received, the cellular modem's baseband processor automatically processes signaling headers and payload streams before the user answers or even receives a ringing notification.
1. Initial Memory Corruption: The attacker transmits malformed video codec parameter sets (specifically H.264/H.265 SDP configurations) over the IMS data channel.
2. Baseband Buffer Overflow: The Unisoc baseband digital signal processing (DSP) firmware suffers an out-of-bounds heap write during video stream buffer initialization.
3. Modem Isolation Breakout: Cellular modems and host application processors communicate via shared Direct Memory Access (DMA) and shared memory IPC buffers (modem_ipc). The attacker leverages the corrupted baseband state to abuse DMA descriptor tables, bypassing the physical memory isolation boundary between the modem and the host application processor (AP).
4. Direct Kernel Memory Manipulation: By mapping arbitrary physical memory pages through the compromised DMA controller, the exploit gains read/write access to host RAM, overwriting Android Linux kernel structures (struct task_struct, cred, and SELinux enforcement flags) to obtain full root execution with disabled security policies.
Affected Hardware & Ecosystem Footprint
* Target Chipsets: Unisoc Tiger T606, Tiger T612, and T7250.
* Device Footprint: Deployed extensively across entry-level and mid-range Android devices manufactured by realme, Motorola, Nokia (HMD Global), Infinix, Tecno, and itel. This represents hundreds of millions of active mobile endpoints across Latin America, Africa, South Asia, and Europe.
Threat Modeling: Zero-Click Over-the-Air Exploitation
Baseband vulnerabilities represent one of the highest-severity threat vectors in mobile security due to several factors:
* No User Interaction: The malicious video call packets are parsed at the radio interface layer before the user accepts or declines the incoming call.
* Over-the-Air Delivery: Attackers require only the target's phone number to transmit the attack over cellular provider networks.
* Total Device Compromise: Breaking from the baseband into host kernel memory grants complete surveillance capabilities, including microphone/camera activation, GPS tracking, SMS/MFA interception, and stored credential theft.
Actionable Recommendations & Mitigations
1. Apply Vendor Security Updates: Device owners must immediately install the latest Android security patches and OEM firmware updates provided by their smartphone manufacturers.
2. Disable VoLTE Video Calling (Interim Workaround): On unpatched devices, users can temporarily disable VoLTE Video Calling / ViLTE in cellular network settings or contact their carrier to disable IMS video services while maintaining standard voice calling.
3. Carrier-Level IMS Filtering: Mobile Network Operators (MNOs) should implement deep packet inspection (DPI) on IMS core networks to filter anomalous video codec negotiation packets and out-of-spec SDP headers.
4. Enterprise Mobile Device Management (MDM): Corporate IT administrators should audit inventory for devices running affected Unisoc chipsets, enforce rapid OS patch compliance, and restrict network access for unpatched models.
Sources & References: The Hacker News, Check Point Research.