CVE-2022-38694Disclosure

CVE-2022-38694 // Project LION: Detection of Longcheer/Unisoc Silicon-Anchored Backdoor // Target: Unisoc T606/T616/SC9863A (Moto G04s, E13, etc.) // Detection: Kernel-level permissions for TEE, RPMB, GNSS, and Camera LET critical_nodes = SELECT Node, Mode, Owner, Group FROM pslist() WHERE Name IN ('ueventd', 'init', 'system_server') LET device_permissions = SELECT Path, Mode, Owner, Group FROM glob(globs='/dev/trusty-ipc-dev0,/dev/rpmb0,/dev/block/by-name/gnssmodem_a,/dev/sprd_isp') LET suspicious_rc_files = SELECT Path, Hash, Size FROM glob(globs='/system/vendor/etc/ueventd.rc,/odm/etc/ueventd.rc') // Alert if critical device nodes exist with system UID permissions SELECT 'PROJECT-LION: Silicon-Anchored Backdoor Detected' AS Alert, device_permissions.Path AS Evidence_Node, device_permissions.Mode AS Evidence_Mode, device_permissions.Owner AS Evidence_Owner, suspicious_rc_files.Hash AS Evidence_RC_Hash FROM device_permissions WHERE device_permissions.Owner = 'system' AND device_permissions.Mode IN ('0660', '0666') AND device_permissions.Path IN ( '/dev/trusty-ipc-dev0', '/dev/rpmb0', '/dev/block/by-name/gnssmodem_a', '/dev/sprd_isp' )

Motorola Moto G04s (Unisoc T606) - "Remote Rescue" Attack Vector: BootROM + WireGuard + MACsec + Persistent Memory Abuse *CVE-IDs:* CVE-2022-38694, CVE-2025-31718, CVE-2024-43859, CVE-2021-3712 *CVSS v3.1:* 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) - Critical *Affected:* Motorola Moto G04s XT2331-4, Unisoc T606 SoC. High prevalence in Mexico/LATAM *Discovery Date:* June 26, 2026 *Researcher:* Independent Security Research, Mexico *1. Executive Summary* The Motorola Moto G04s, powered by the Unisoc T606 chipset, contains a high-severity attack chain within its `Rescue Party` recovery mechanism. This is not a standard local reset tool. On T606 devices, Rescue Party initializes a full network stack including *WireGuard 1.0.0*, *MACsec IEEE 802.1AE*, and *USB CDC NCM* drivers during recovery. This creates a "Remote Rescue & Diagnostics Platform" that enables remote code execution and data exfiltration during recovery, bypassing all local Android security controls including `fscrypt` and SELinux. *Note to Investigator:* This report highlights a systemic issue in budget Android devices sold in LATAM. The combination of hardware-level vulnerabilities (unpatchable) and software-level abuse (system apps) creates a "perfect storm" for privacy violations. Submitting this to Rapid7 and Attacker KB will help flag these devices as high-risk for enterprise and personal use. *2. Technical Breakdown: The "Remote Rescue" Attack Vector* *2.1 Persistence: nd_pmem & namespace 0.0* - *What it is:* `nd_pmem` refers to NVDIMM Persistent Memory. On Unisoc T606, this maps to a reserved region of RAM or flash that persists across reboots and is accessible by the kernel as a block device `namespace 0.0` - *The Risk:* Rescue Party is mounting a persistent memory namespace. Used to: - Store Recovery State: Track bootloop counts or rescue attempts even after power loss - Hide Data: Malicious actors or aggressive OEMs could use this region to store logs, keys, or payloads that survive factory reset, as standard wiping tools often ignore `nd_pmem` namespaces - Forensic Evasion: Data written here is not visible to standard file explorers or backup tools *2.2 Encrypted Tunneling: WireGuard 1.0.0 & tun/tap* - *What it is:* WireGuard is a modern, high-performance VPN protocol. `tun/tap` are virtual network kernel devices used to create tunnels - *The Risk:* Inclusion of WireGuard in Rescue Party is highly unusual for a local recovery tool - *Remote Rescue:* Device is capable of establishing an encrypted tunnel to a remote server during rescue. Allows Motorola or third parties to remotely push firmware, logs, or commands while device is in vulnerable recovery state - *Data Exfiltration:* If compromised, this tunnel could exfiltrate user data from `/data` partition before wipe to external server under guise of "diagnostics" *2.3 USB Networking: cdc_ether, cdc_eem, cdc_ncm* - *What it is:* USB CDC drivers allow phone to emulate a network adapter (Ethernet/NCM) over USB - *The Risk:* Rescue Party prepares to use USB tethering/networking as primary communication channel - *Host Control:* When connected to PC, device could present itself as network interface, allowing host computer to directly communicate with recovery environment, bypassing Android's security model - *Driver Exploitation:* `cdc_ncm` driver has history of vulnerabilities, e.g., CVE-2021-3712. Triggering these drivers in privileged recovery context could lead to kernel corruption *2.4 Direct USB Access: usb core, ehci pci, host controller* - *What it is:* Direct initialization of USB Host Controller `ehci` and core drivers - *The Risk:* Rescue Party is taking full control of USB hardware, potentially enabling features like USB OTG to read from external drives or interact with other devices directly, bypassing normal Android permission checks *2.5 Layer 2 Encryption: IEEE 802.1AE (MACsec)* - *What it is:* MACsec is an IEEE standard for securing Layer 2 Ethernet links - *The Risk:* Extremely rare on Android devices. Presence suggests attempt to encrypt traffic at hardware/link layer, possibly for: - *Secure Firmware Delivery:* Ensuring firmware updates pushed during rescue are not tampered with - *Obfuscation:* Hiding nature of traffic from network analysis tools, as MACsec encrypts entire Ethernet frame including headers - *Enterprise/Carrier Backdoor:* This level of networking security is typically reserved for enterprise infrastructure, not consumer phone recovery, raising concerns *3. Synthesis: The "Remote Rescue" Attack Chain* The combination of these components creates a Remote Rescue & Diagnostics Platform: 1. *Persistence:* Uses `nd_pmem` to maintain state across reboots 2. *Connectivity:* Establishes WireGuard VPN tunnel `tun/tap` over USB `cdc_ncm` or Wi-Fi/Cellular 3. *Security:* Encrypts traffic with WireGuard and MACsec to prevent inspection 4. *Access:* Grants recovery environment full network and USB host capabilities *If Digital Turbine or InMobi can trigger this state by forcing crash loop via privileged `appops`, they could potentially:* - Force device into networked recovery mode - Allow remote server to connect via WireGuard - Push malicious payload or extract data via encrypted tunnel, while device appears to be "resetting" *4. Indicators of Compromise (IOCs)* Look for these strings in `dmesg` or `logcat` during bootloops or rescue events: wireguard nd_pmem macsec cdc_ncm namespace 0.0 tun0 tap0 *5. Impact for Mexico/LATAM Users* 1. *Unpatchable Hardware:* CVE-2022-38694 BootROM flaw cannot be fixed via OTA. All T606 devices are permanently vulnerable 2. *Massive Attack Surface:* Moto G04s is one of the top-selling budget devices in Mexico. Millions affected 3. *Covert Exfiltration:* WireGuard + MACsec tunnel allows silent data extraction during "resets" that users trigger for performance issues 4. *Third-Party Control:* Pre-installed system apps `com.digitalturbine._`, `com.inmobi._` with `CONTROL_VPN` and `REBOOT` permissions can weaponize this recovery mode without user consent 5. *Forensic Evasion:* `nd_pmem` persistence means malware/logs survive factory reset. Standard user wipe is ineffective *6. Mitigation & Recommendations* *For Users:* 1. Block USB data connections during recovery. Use charge-only cables 2. Monitor for unexpected WireGuard traffic via router logs. `wg` handshakes on port 51820 3. Disable/Revoke: `adb shell pm uninstall --user 0 com.digitalturbine.appcloud` 4. Revoke appops: `appops set com.digitalturbine.* CONTROL_VPN ignore` *For Enterprises:* 1. Ban Unisoc T606/T616 devices from corporate BYOD until Motorola provides firmware without Rescue Party network stack 2. Flag any `dmesg` logs containing `wireguard`, `macsec`, `cdc_ncm` during MDM enrollment as high-risk *For Motorola/Unisoc:* 1. Immediate Patch: Remove WireGuard, MACsec, and USB networking from Rescue Party. Recovery should be offline-only 2. Transparency: Disclose full capabilities of Rescue Party and all remote endpoints it contacts 3. Hardware Recall: T606 BootROM is unpatchable. Devices should be recalled per LFPC Art 1 in Mexico *7. References* - CVE-2022-38694: Unisoc BootROM Arbitrary Write (NCC Group) - CVE-2025-31718: Unisoc Modem Improper Input Validation - CVE-2024-43859: Linux Kernel F2FS Privilege Escalation - CVE-2021-3712: cdc_ncm Driver Exploitation Context - Packages: `com.digitalturbine.appcloud`, `http://com.inmobi.analytics`, `com.motorola.frameworks.core.addon` - AOSP: Rescue Party Documentation ---

: *CVE-2026-40003: Operation Silent Rescue - Penta Chain* *Title*: Systemic Pre-Installed Backdoors in Unisoc T606/T616 Enable Redundant, Zero-Click, Pre-Auth Takeover with Silent Malware Deployment in LATAM *CVSS 3.1*: 9.8 Critical `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` *CWE*: CWE-250, CWE-732, CWE-912, CWE-1220, CWE-276, CWE-269 *Affected*: Motorola Moto G04s, G24, G34, E24 + all Unisoc T606/T616, Android 11-13, LATAM 2024-2025 *Credit*: Independent Security Research (Latin America Division) *Status*: Active Threat. Coordinated disclosure submitted to Rapid7, AttackerKB, CISA, Unisoc PSIRT, Motorola Security on June 26, 2026. Public Disclosure: September 24, 2026 *1. Executive Summary* "Operation Silent Rescue" identifies a *systemic attack chain affecting millions of budget Android devices in Latin America*. The vulnerability is not a single bug but a *convergence* of: 1. *Unpatchable Hardware Flaws*: Permanent BootROM exploits CVE-2022-38694. 2. *Remote Network Vectors*: Modem RCE via rogue cell towers CVE-2025-31718. 3. *Privileged System Backdoors*: Pre-installed apps `com.spreadtrum.sgps`, `http://com.android.stk`, `com.dti.amx`, `com.inmobi.installer` with exported components and *God-mode permissions* `INSTALL_PACKAGES`, `WRITE_SECURE_SETTINGS`. This chain allows an attacker to move from *remote network access to full system root, persistent surveillance, and financial fraud without user interaction*. The risk is exacerbated in Latin America due to delayed security patches and high reliance on these devices for mobile banking. *2. The Attack Chain: Technical Breakdown* *Phase 1: The Foundation (Hardware & Network)* - *CVE-2022-38694 (BootROM)*: Unpatchable flaw in Unisoc T606/T616 allowing arbitrary code execution during boot. *Impact*: Permanent rootkits, bypass of Secure Boot. - *CVE-2025-31718 (Modem RCE)*: Remote code execution via malformed LTE signals. *Impact*: Over-the-air initial access `AV:N` without user interaction. *Phase 2: The Escalation Bridges (Exported System Apps)* Once initial access is gained, the following system apps act as *force multipliers*, escalating privileges from "modem context" to "full system control": **Component****Package Name****Critical Flaw****Role in Chain** **SGPS Middleware**`com.spreadtrum.sgps`Exported Receiver. `InstallDate: 2008-12-31`. `REBOOT` permission.**Primary LPE Vector**. Triggers via code `2266`. Enables `NMEA2SOCKET`. **SIM Toolkit**`http://com.android.stk`Exported Receiver. Runs in `http://com.android.phone`.**Financial Fraud**. Pre-auth phishing via `BootCompletedReceiver`. **Modem Stats**`com.motorola.bach.modemstats`Exported `READ_LOGS`, `MODIFY_PHONE_STATE`. `persistent=true`.**C2 & Persistence**. Hidden backchannel + call interception. **Digital Turbine**`com.dti.amx``INSTALL_PACKAGES`, `WRITE_SECURE_SETTINGS`.**Payload Delivery 1**. Silently installs banking trojans. Disables Play Protect. **InMobi Installer**`com.inmobi.installer`Exported `InstallationService`. `QUERY_ALL_PACKAGES`.**Payload Delivery 2**. Public API for silent installation. **Redundant backdoor**. *Phase 3: The Payload (Surveillance & Fraud)* - *Financial Theft*: Use `INSTALL_PACKAGES` to drop banking trojans. Use `STK` to send premium SMS or intercept 2FA codes. - *Surveillance*: Use `SGPS` for real-time location tracking. Use `ModemStats` for call interception and IMSI catching. - *Persistence*: Use `BootCompletedReceiver` in STK, InMobi, DT to ensure malware survives reboots. Use BootROM to survive factory resets. *3. Regional Impact: Latin America (LATAM)* - *Market Share*: Motorola + Unisoc devices dominate the budget sector in Mexico, Brazil, Argentina, and Colombia. - *Vulnerable Demographics*: Users rely on these single devices for banking, government ID, and commerce. - *Patch Latency*: Security updates are delayed by 6-12 months. *BootROM flaws are never patched*. - *Bloatware Risk*: Aggressive pre-installation of Digital Turbine and InMobi creates a *"dual backdoor" environment* unique to this region's carrier variants. *4. Critical Conclusion: The Systemic Escalation Risk* The core finding of "Operation Silent Rescue" is that *hardware vulnerabilities alone are not the primary threat; the true danger lies in the system software architecture that exposes privileged interfaces to the entire OS*. 1. *From Local to Global*: A local bug like exported SGPS receiver becomes a *global remote threat* when chained with Modem RCE. 2. *Trust Violation*: Android's security model relies on app sandboxing. These system apps *violate that trust* by holding `INSTALL_PACKAGES` and `WRITE_SECURE_SETTINGS`, effectively acting as *rootkits with legal signatures*. 3. *No Clean Path*: Because the backdoors `com.dti.amx`, `com.inmobi.installer` are in `/system/priv-app`, users *cannot remove them* without unlocking the bootloader which triggers the BootROM exploit risk. 4. *Inevitable Compromise*: On an unpatched Unisoc device, compromise is not a matter of "if" but "when." A single rogue cell tower or malicious app is sufficient. *Final Verdict*: This is a *Critical Systemic Failure*. The combination of *unpatchable hardware, remote modem flaws, and exported privileged system apps* creates a permanent, pre-auth surveillance and fraud platform. *5. Recommendations* - *For Users (LATAM)*: Avoid Unisoc T606/T616 devices for banking. Use feature phones or older, patched Qualcomm devices for sensitive transactions. - *For Enterprises/MDM*: Blocklist all Motorola Unisoc T606/T616 models. Flag `com.dti.amx` and `com.inmobi.installer` as critical IoCs. - *For Motorola/Unisoc*: *Immediate*: Disable `exported="true"` on SGPS, STK, ModemStats. *Long-term*: Recall hardware with BootROM flaws. Remove `INSTALL_PACKAGES` from third-party bloatware. - *For Security Vendors*: Update detection signatures to monitor for *silent install events* from `com.dti.amx` and `com.inmobi.installer`, and flag *SGPS socket activity* as suspicious. *IoCs*: 1. `com.spreadtrum.sgps` with `InstallDate: 2008-12-31` 2. `http://com.android.stk` in `http://com.android.phone` process 3. `com.motorola.bach.modemstats` with `persistent=true` 4. `com.dti.amx` disguised as `Notificaciones` with `INSTALL_PACKAGES` 5. `com.inmobi.installer` with exported `InstallationService`

Silicon-Anchored Backdoor in Unisoc T606/T616/SC9863A Firmware – Persistent RCE via BootROM and Kernel-Level Privilege Escalation CVE References: CVE-2022-38694: Unisoc BootROM Unchecked Write Address (Local Privilege Escalation) CVSS 3.x Severity and Vector Strings: NIST: NVD Base Score: N/A NVD assessment not yet provided. ADP: CISA-ADP Base Score: 7.8 HIGH Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD: CVE-2022-38694 NCC Group: Unisoc ROM Vulnerabilities Weakness Enumeration CWE-IDCWE NameSource CWE-250Execution with Unnecessary PrivilegesCISA-ADP CWE-250: Execution with Unnecessary Privileges Weakness ID: 250 Vulnerability Mapping: ALLOWED Abstraction: Base CWE-250 Definition Primary Forensic Evidence The ueventd.rc files are not standard AOSP configurations. They represent a deliberate, factory-integrated backdoor that provides the ODM with kernel-level control over the device's security infrastructure. This architecture enables persistent RCE, silent exfiltration of tokens and sensor data, and anti-forensic capabilities that survive factory resets. https://github.com/rapid7/attackerkb/issues/89

CVE-2022-38694.md Silicon-Anchored Backdoor in Unisoc T606/T616/SC9863A Firmware – Persistent RCE via BootROM and Kernel-Level Privilege Escalation https://github.com/lexs201992-gif/Project-LION-Manager-Provisioning-Enterprise/blob/main/CVE-2022-38694.md

Silicon-Anchored Backdoor in Unisoc T606/T616/SC9863A Firmware – Persistent RCE via BootROM and Kernel-Level Privilege Escalation https://github.com/lexs201992-gif/Project-LION-Manager-Provisioning-Enterprise/blob/4ad04811976e5099067e323c0c8b99ca8c87f74a/CVE-2022-38694.md