VoLTE stack overflow attack, Why We Modularize Modems & GrapheneOS is not enough

[Privacy2]

@biketool

This is why systems like GrapheneOS installed on a normal Pixel or Motorola phone with a trusted modem inside with DMA access can still never be trusted, the modem can execute code on the main CPU to rewite anything and everything it wants to until the OS and software is something completely unrecognizable, …

Do you understand the purpose and IOMMU constraints within GrapheneOS???

The whole point of IOMMU is to effectively restrict memory access for peripherals who have DMA. The cellular modem in GrapheneOS is restricted to access only very specific and well-defined memory buffers and they absolutely can not rewrite any part of the OS.

What is notable is:

1. The Librem 5 does not have any IOMMU.
2. While the cellular modem for the Librem 5 doesn’t have DMA access because it’s on a USB2 bus, I wager the Librem 5 v2 will not have the cellular modem on a USB2 bus and will have DMA. It’s not the integration of the cellular modem that’s an issue, it’s that most modern bus structures have DMA.

Also it’s worth pointing out that the exploit is one specific to a completely different chipset than on Pixel phones with GrapheneOS. So the question is: Why did you mention GrapheneOS at all??? As I understand it, the “ARM Memory Protection Unit” on that cheap SoC is not a IOMMU. It’s not a separate component on the SoC and is built into the cellular modem chipset. Basically this was the sort of attack you should expect on phones with no IOMMU but with DMA … and it’s the whole reason why you need IOMMUs when pretty much everything on modern systems have DMA.