Amazon Fire TV Cube hacked using 4-year-old bug: movie fans are not scared, they’re ecstatic

Amazon Fire TV Cube has been hacked – the device is vulnerable to a 4-year-old GPU bug, granting attackers root. Instead of security panic, the discovery is driving huge excitement amongst video and audio enthusiasts, who are turning Cube into an ultimate media player.

Fire TV Cube 3rd Gen has a fundamental weakness – a severe ARM Mali GPU kernel driver vulnerability. Four years have passed since the bug was discovered, patched, and documented.

Cube runs Android under the hood.

The exploit enables arbitrary kernel code execution and root access. Attackers and malicious apps can leverage the highest privileges to gain complete control over the device.

However, it was home theater enthusiasts who jumped at the new exploit first, rather than security researchers or attackers.

They are now modifying Cube to make it a better media player than it currently is – capable of playing nearly every video and audio format imaginable.

Sideloading apps, removing Amazon’s components, or even reinstalling a completely different OS is possible once you are root.

But it’s also a cybersecurity risk for users until the vulnerability is patched.

Protecting the security of our customers and devices is our top priority. What’s being demonstrated poses little risk to customers; it’s someone modifying a device they own to run unofficial software, which requires direct physical access and a deliberate, multi-step process,

an Amazon spokesperson told Cybernews.

Complete control

The exploit chain for unlocking Fire TV Cube Gen 3 was initially shared on XDA Forums, an online community for developers, programmers, and technology enthusiasts.

Pro-me3us, a senior member who detailed the entire procedure, lists several reasons users might want to unlock the device and install Magisk, a free tool for maintaining persistent root access.

Replacing built-in recovery with TWRP, a touch-friendly Android recovery program, enables easier system backups and custom firmware installation. Unrestricted remote device control is achieved using Fastboot and the open-source bootloader U-boot.

From there, users can install multiple operating systems, such as a Kodi-based media center (CoreELEC) or a retro-gaming console (EmuELEC).

Various FireOS modifications are available: custom launchers, local ADB access, modifications to system and vendor partitions, custom ROMs, kernels, and more.

The unlock highlights the security irony – Amazon enforces strict locking policies to prevent tampering, yet left a legacy backdoor to bypass all controls.

Home theater enthusiasts met the news with massive joy, and comments like these: “This is awesome! Thanks!” “You are the King,” “Awesome indeed! Amazing work!”

The Amazon spokesperson warns that modifying a device this way falls outside its intended use and can affect its security, performance, and warranty coverage.

“We’re reviewing the details and will take appropriate action as needed.”

said the Amazon spokesperson.

But why is it such a big deal for movie enthusiasts?

No TV device on the market currently can play everything from one box.

Popular TV sticks and boxes excel at streaming because they have the required certifications from Netflix and other services to output content at the highest available quality – still compressed.

But they lack support for the passthrough of lossless audio formats like Dolby Atmos TrueHD or DTS:X, struggle with local media playback, especially high-bitrate files, and advanced video containers. Some popular video formats, such as Dolby Vision HDR and HDR10+, are often unavailable for local streaming.

For casual Netflix viewers, this might not mean much, but it’s very important for home theater enthusiasts with multi-channel audio setups and the itch to see the content at maximum quality, as the creators intended.

The other end of the spectrum offers high-end local media playback devices. They’re often expensive, support many of the advanced audio and video formats, but fail at streaming – they don’t have certifications for Netflix.

To this day, Nvidia Shield Pro, released in 2019, is praised as a gold standard for high-end home theaters because it combines streaming and local media playback with lossless audio passthrough. However, even the aging Shield now lacks support for formats such as AV1, HDR10+, HLG, and it can’t fully decode Dolby Vision Profile 7 FEL (Full Enhancement Layer), found on Blu-ray discs.

“Hacking” remains the only option to combine both worlds and build an ultimate TV box.

Home theater enthusiasts are on the constant lookout for devices with Dolby Vision-certified hardware (often Amlogic SoCs) that can be rooted and dual-booted for local media playback. Many turn to Android TV boxes from China and flash them with custom firmware.

That’s where the “rooted” Amazon Fire TV Cube comes in. The stock device lacks desired capabilities, which can be unlocked by rooting and installing CoreELEC, a lightweight Linux distro designed to run Kodi.

“The FireOS UI is ad-ridden in all Fire devices, but if you root Cube 3, you can install an ad-free custom launcher,” one of the enthusiasts noted.

What do we know about the bug?

The ARM Mali kernel driver bug that made root access on Fire TV Cube 3rd Gen possible (CVE-2022-38181) is rated 8.8 out of 10 on the severity scale.

It was patched by ARM even before the latest Cube's launch.

In July of 2022, Man Yue Mo, a security researcher at GitHub Security Lab, initially reported the discovered bug to the Android security team on July 12th, 2022. Arm patched kernel drivers a month later, on August 12th.

The Fire TV Cube Gen 3 was released on October 25th, 2022. Device makers are responsible for integrating and distributing patches to users. It remains unclear if the Cube remained vulnerable for the entire four years or if the bug was reintroduced later.

“GPU drivers on Android are a very attractive target for an attacker, as they can be reached directly from the untrusted app domain,” the researcher explained in the follow-up detailed write-up of the vulnerability.

“Relatively few bugs can cover a large number of devices.”

At the time of discovery, the researcher hacked a Pixel 6 device for an Android app.

Many XDA Forums and AVS Forum community members have already confirmed that the Fire TV Cube exploit is working. Some video guides on how to root the device are already available on YouTube.

The exploit creators explained that they modified the original code to accommodate FireOS’s 32-bit userspace.

Even the developers of the exploit acknowledge that the window of opportunity is likely temporary.

“Once patched, I don’t expect another gazelle unlock opportunity,” Pro-me3us said.

The vulnerability doesn’t mean that ordinary Cube owners are in immediate danger. Potential attackers would need a foothold on the device to exploit the bug before taking it over – a malicious app or another way to run malicious code.

There’s no evidence that threat actors are actively exploiting the bug in the wild. Potentially, it could be leveraged to incorporate vulnerable devices into botnets, spy via the microphone or other activity, conduct network attacks, steal data, and carry out other cyberattacks.

Beware that unofficial modifications can permanently damage or “brick” the device, void its warranty, and introduce additional security risks.