Last Updated: 2026-06-20T04:02:14Z
Summary
A hardware flaw in the Synopsys DWC2 USB controller used by the A12/13 & S4/5 chips, as well as a misconfiguration allows for unsigned code execution.
Notes
Setup packets within the setup transaction must be exactly 8 bytes according to the specification. The Application Processor configures Direct Memory Access by allocation a memory region and writing the physical address to the DOEPDMA register.
The USB controller stores up to three consecutive setup packets in memory. When it receives a fourth, DOEPDMA is decremented by 24.
The bug is that the controller also accepts smaller packets of size 4, rather than 8. This results in a buffer underflow through 12 byte steps. Further, on the A12 and A13, USB DART is configured in bypass mode, allowing free SRAM writes. A14 and later configure DART correctly.
The exploit requires DFU mode and physical access. As this is a hardware vulnerability, all you can really do is get a newer device with an A14 or later.
Vulnerable chips
- A12
- A13
- S4
- S5
- Theoretically A12X/Z, but not implemented in the PoC
Sources