Google Enhances Pixel 10 Modem Firmware Security

What Happened

Google is taking significant steps to enhance the security of its Pixel phones, particularly focusing on the cellular baseband modem. This component is crucial as it manages communication with mobile networks and processes external data. With the introduction of the Pixel 10, Google has integrated a new DNS parser written in the Rust programming language into the modem firmware. This follows earlier efforts with the Pixel 9, where measures were implemented to reduce memory-related vulnerabilities.

The Flaw

The DNS protocol is essential for directing browsers to websites and is also pivotal in cellular networks for functions like call forwarding. However, handling complex data from external sources can introduce vulnerabilities, especially when implemented in memory-unsafe programming languages. The Pixel modem contains tens of megabytes of executable code, which poses a significant remote attack surface. Despite the improvements, other critical memory safety vulnerabilities may still exist within the predominantly memory-unsafe firmware code.

Security Enhancements

The new Rust-based DNS parser aims to mitigate an entire class of vulnerabilities in this risky area. By using an open-source DNS library called hickory-proto, Google adapted it for modem firmware, which operates without the standard Rust library in a setup known as no_std. The integration of this code increases the firmware size by approximately 371 KB, which was deemed acceptable for Pixel devices.

Challenges and Future Work

While the added code size may be a limitation for other embedded systems, Google plans to address this by potentially adding feature flags for conditional compilation in the future. This modularity would allow only the necessary functionality to be included, optimizing the firmware size further.

Implementation Details

Integrating the Rust parser required connecting it to the existing C and C++ firmware. This involved creating interfaces for data exchange. When the modem receives DNS data, it is processed by the Rust parser, which then interacts with existing C functions to utilize the results. During initial testing, performance issues arose due to linking optimized functions, leading to power and performance problems. These were resolved by adjusting the linking process.

Conclusion

Google's ongoing efforts to enhance the security of its Pixel devices through improved modem firmware are commendable. By adopting Rust for critical components, the company is not only reducing vulnerabilities but also laying the groundwork for broader adoption of memory-safe code in future updates. This proactive approach is vital in an era where mobile security threats continue to evolve.