Google Researcher Shows Android Kernel Memory Layout Is More Predictable Than Expected

A Project Zero researcher working on Pixel kernel exploitation found himself with a powerful ability to write to arbitrary kernel memory, but without a way to defeat KASLR, a protection that randomises where kernel components sit in memory. Rather than hunting for a traditional leak, he examined the Linux kernel's linear mapping, a region of kernel address space that directly mirrors the phone's physical memory in a simple 1:1 layout.

Working with colleague Jann, the researcher studied how the kernel chooses where to place this region. On Android, the starting address of the mapping can be calculated from a fixed configuration setting. The other value needed, memstart_addr, can be looked up on a rooted device using a tool Jann wrote to read kernel memory for analysis. Its value was 0x80000000, which does not look random at all.

The explanation is that this value was theoretically randomised at every boot, but in practice this has not happened on arm64 for some time. As of a specific kernel commit (1db780bafa4c), randomisation of the linear map is no longer a supported feature in the arm64 Linux kernel. In short, a layer of protection many assume is active is effectively absent. This is the opening of a longer article, so further detail is not covered here.