I do not think that a radio interface could have enough access to facilitate decryption of an encrypted volume. What I imagine it has enough access to do is to pivot to the OS running on the main CPU via a bug in the interface that is exposed for the radio to communicate with the main CPU.
From there they would likely have to exploit a number of other bugs to get into the position that they want to be in.
To protect the device from vulnerabilities in network processor firmware, network interfaces including Wi-Fi and baseband have limited access to application processor memory. When USB or SDIO is used to interface with the network processor, the network processor can’t initiate Direct Memory Access (DMA) transactions to the application processor. When PCIe is used, each network processor is on its own isolated PCIe bus. An IOMMU on each PCIe bus limits the network processor’s DMA access to pages of memory containing its network packets or control structures.
Of course there's always the chance that there's a bug in one of these interfaces
And on Android: ¯\_(ツ)_/¯ Even for the Google Pixel I can't find a security whitepaper, just a blog post with a couple of vague bullet points.
Comments
Can you be more specific about the nature of the exploit you are imagining?
For example, how can a radio interface have "enough" access to facilitate decryption of an encrypted volume?
I do not think that a radio interface could have enough access to facilitate decryption of an encrypted volume. What I imagine it has enough access to do is to pivot to the OS running on the main CPU via a bug in the interface that is exposed for the radio to communicate with the main CPU.
From there they would likely have to exploit a number of other bugs to get into the position that they want to be in.
The radios quite probably use DMA to blast bits to/from main memory.
Get code execution on the radio chip, use that to harvest the decryption keys from RAM and the rest is pretty trivial.
From the iOS security whitepaper:
Of course there's always the chance that there's a bug in one of these interfaces
And on Android: ¯\_(ツ)_/¯ Even for the Google Pixel I can't find a security whitepaper, just a blog post with a couple of vague bullet points.
Isn't the key in a part of RAM only accessible through the Secure Enclave? (As in, you shouldn't be able to set up DMA to certain ranges.)