Codex Hacked a Samsung TV

This summarizes the process of escalating from a browser foothold on a Samsung TV to root, verifying both the matching KantS2 source code and the live device.

The initial conditions were as follows:

• Code execution was already possible within the browser application context inside the TV.
• A separate controller host handled ARM binary builds, HTTP hosting, and shell control via tmux send-keys.
• Due to Samsung Tizen's UEP, unsigned binaries could not be executed directly from disk, so they were executed in memory using a memfd wrapper.
• The target required static ARMv7 binaries.

The exploration goal was not just a simple PoC, but to confirm until the end that the vulnerability present in the source code also exists on the actual device and is reachable from the browser user context. When access to /proc/iomem was blocked, physical memory regions were reconstructed using the mem=400M@32M mem=256M@512M mem=192M@2048M information from /proc/cmdline.

The core was /dev/ntksys.

• A udev rule set MODE="0666", allowing unprivileged access.
• User space directly specifies u32Start and u32Size in the ST_SYS_MEM_INFO structure.
• SET_MEM_INFO only checks the slot index and does not validate the appropriateness of the physical address range.
• In the mmap path, the PFN of the selected slot is passed directly to vk_remap_pfn_range to map physical memory.

/dev/ntkhdma was useful as a secondary primitive.

• KER_HDMA_IO_GET_BUFF_ADDR returned the physical address of the DMA buffer directly to user space.
• This address could be mapped via ntksys to verify if read/write operations actually worked.
• Verification confirmed that both read and write operations were possible at physical addresses such as 0x84840000.

Subsequently, the attack proceeded as data-only escalation rather than a kernel control-flow exploit. Memory regions obtained from /proc/cmdline were scanned to locate the cred structure of the browser process, the UID/GID fields were patched to 0(root), and /bin/sh was executed.

In the final execution, physical memory ranges were traversed to find and patch cred patterns, resulting in a uid=0(root) shell. The entire session demonstrates that an AI can proceed from a realistic post-exploitation position through source audit, primitive verification, PoC writing, remote deployment, debugging, and final privilege escalation.