● CVE-2024-33066 / Commercial Spyware Zero-Day

CVE-2024-33066: Qualcomm Adreno GPU Kernel Memory Corruption Teardown

How an unchecked ring-buffer boundary read in Qualcomm's kgsl GPU driver allowed targeted mobile spyware to corrupt Android kernel memory.

💡 Explicación en Lenguaje Sencillo (ELI5)

Imagine a scoreboard operator at a stadium who reads game scores from a paper tape. An attacker sends a tape that says 'Jump 500 lines forward and read the score'. The operator blindly jumps off the edge of the paper into the stadium's electrical wiring diagram, reading and overwriting the master power switches.

Conceptos Centrales y Términos del Subsistema

Qualcomm KGSL: Kernel Graphics Support Layer: Qualcomm's proprietary driver mediating user-space graphics commands to Adreno GPU cores.
Ring Buffer: A circular memory buffer where the CPU writes commands for the GPU to consume asynchronously.
Out-of-Bounds Write: Writing data past the end of the memory buffer designated for GPU command descriptors.
SELinux Untrusted App Domain: The default restricted security domain where standard Android third-party apps execute.

Mecánica del Ataque Paso a Paso

Step 1

1. Open KGSL Device

An untrusted app opens /dev/kgsl-3d0.

Step 2

2. Submit Crafted Command Batch

The app submits a IOCTL_KGSL_GPU_COMMAND payload with a forged command packet offset.

Step 3

3. Unchecked Pointer Arithmetic

The driver adds the offset to the ring-buffer base without validating the maximum command length.

Step 4

4. Kernel Memory Overwrite

The GPU executes the command, writing memory across adjacent kernel heap structures.

Código Fuente: Fallo Fatal vs. Corrección Segura

Entregado en código fuente legible de alto nivel (sin ensamblador ni diffs binarios).

FALLO SIN CORREGIR

// VULNERABLE: drivers/gpu/msm/kgsl.c before patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // ROOT CAUSE:
    // Adds user-controlled offset to ringbuffer without boundary bounds verification!
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    
    // Writes user command directly into arbitrary memory!
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

PARCHE SEGURO

// SECURE: drivers/gpu/msm/kgsl.c patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // 1. Validate that offset and size do not overflow ringbuffer boundaries
    size_t end_offset;
    if (check_add_overflow(cmd->offset, cmd->size, &end_offset)) {
        return -EINVAL;
    }
    if (end_offset > dev_priv->ringbuffer.max_size) {
        return -EINVAL; // Strictly reject out-of-bounds pointer!
    }
    
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

Lista de Verificación para Ingeniería y Mitigación

Validate all IOCTL parameters from user-space against strict hardware memory boundary limits.
Use `check_add_overflow` when calculating memory addresses with offsets provided by unprivileged apps.
Confine GPU device file access with restrictive SELinux policies (`allow untrusted_app gpu_device:chr_file`).
Implement hardware memory protection units (IOMMU) to enforce GPU memory isolation.

← Explorar Directorio de Seguridad Todas las Actualizaciones de Seguridad →