Android ION Hazard - The Curse of Customizable Memory Management System
Explore a conference talk from CCS 2016 that delves into the security vulnerabilities of Android's ION memory management system. Learn about the challenges posed by customizable memory management in mobile operating systems, focusing on denial-of-service attacks and information leaks. Discover the traditional and new design approaches for meeting everyday and special memory requirements in Android. Examine case studies of security flaws, including CVE-2015-8950, which allowed live memory dumps. Gain insights into the discovery process for these vulnerabilities and potential defense strategies. Understand the root causes of uninitialized memory issues stemming from customization and complexity. Conclude with industry feedback on the presented findings and their implications for mobile device security.