SECURITY DISCLOSURE. Sophgo SG2000 / CV181x mask ROM.
A single strap-selectable polyglot fip.bin pwns both cores of the SG2000 at once, obliterating every level of secure boot the silicon has. Is this the first bootloader unlock for two architectures at once? Full briefing below.
One polyglot fip.bin pwns both cores of the SG2000 at once.
The same file hijacks the aarch64 A53 and the RISC-V C906 mask
ROMs, then chainloads NixOS on whichever core the GPIO strap selects.
Both cores load one shared oversized BL2 whose first instruction is a dual-ISA trampoline: the same bytes decode to a valid branch on aarch64 and on RISC-V with different displacements. From there, each core relocates a small stub, reopens the SD card through the ROM's own FatFs, loads a second image, and launches it, all before any secure-boot verification runs.
Since this is a mask ROM vulnerability, there is no patch possible for these chips, and they are broken until Sophgo ships a new silicon revision.
The mask ROM copies the FIP's BL2 image using an attacker-controlled, unbounded
BL2_IMG_SIZE field before it decrypts or verifies BL2. This BL2 image ends
up overlapping with the mask ROM's stack prior to secure boot verification.
Drop the exploit fip.bin on the SD card and it will boot every time.
The size field lives in the FIP's param1 header, which is protected only by a
CRC-16 checksum rather than a signature.
It defeats every secure-boot level the part supports:
VRK4.VBK.VCC.PE.BS.J.PWNED. The
key chain verifies, then control is taken before the BL2 signature is checked.VRK4.VBK.DK4.VCC.PE.BS.J.PWNED. The ROM even unwraps the image-encryption key
first, then hands control to our plaintext bytes. Very nice of it!No fuse setting changes where BL2 is loaded.
We dumped the 96 KiB mask ROM from inside BL2, the only context that can read it,
and reversed the FIP loader's verify sequence on both cores. They are identical:
VRK, VBK, DK, VCC, VCP, load BL2, BL2 cksum, DB2, VB2. The overrun happens at
load BL2, several steps before DB2 (decrypt) and VB2 (verify).
We found it after building a polyglot FIP for the Nix Badge's multi-architecture build. We wanted one image both cores would accept, which meant working out how the SG2000's FIP format actually works instead of how the documentation says it does.
eMMC, SPINAND, and other boot modes are equally affected but will require a different stack map in order to work since the affected function is at a different stack depth. This demo was made for an SD card (hence the SD/... in the mask ROM boot line).
TBD
Chevron seven, locked.
