● CVE-2024-33066 / Commercial Spyware Zero-Day

CVE-2024-33066: Qualcomm Adreno GPU Kernel Memory Corruption Teardown

How an unchecked ring-buffer boundary read in Qualcomm's kgsl GPU driver allowed targeted mobile spyware to corrupt Android kernel memory.

💡 身近な例えで分かる解説 (ELI5)

Imagine a scoreboard operator at a stadium who reads game scores from a paper tape. An attacker sends a tape that says 'Jump 500 lines forward and read the score'. The operator blindly jumps off the edge of the paper into the stadium's electrical wiring diagram, reading and overwriting the master power switches.

中核となる概念とサブシステム用語

Qualcomm KGSL: Kernel Graphics Support Layer: Qualcomm's proprietary driver mediating user-space graphics commands to Adreno GPU cores.
Ring Buffer: A circular memory buffer where the CPU writes commands for the GPU to consume asynchronously.
Out-of-Bounds Write: Writing data past the end of the memory buffer designated for GPU command descriptors.
SELinux Untrusted App Domain: The default restricted security domain where standard Android third-party apps execute.

ステップ別エクスプロイト実行メカニズム

Step 1

1. Open KGSL Device

An untrusted app opens /dev/kgsl-3d0.

Step 2

2. Submit Crafted Command Batch

The app submits a IOCTL_KGSL_GPU_COMMAND payload with a forged command packet offset.

Step 3

3. Unchecked Pointer Arithmetic

The driver adds the offset to the ring-buffer base without validating the maximum command length.

Step 4

4. Kernel Memory Overwrite

The GPU executes the command, writing memory across adjacent kernel heap structures.

ソースコード比較：致命的バグ vs 安全な修正

日常的な開発者が直感的に理解できる高級言語コードで提示（バイナリやアセンブリ不使用）。

未修正の脆弱なコード

// VULNERABLE: drivers/gpu/msm/kgsl.c before patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // ROOT CAUSE:
    // Adds user-controlled offset to ringbuffer without boundary bounds verification!
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    
    // Writes user command directly into arbitrary memory!
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

修正済みの安全なコード

// SECURE: drivers/gpu/msm/kgsl.c patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // 1. Validate that offset and size do not overflow ringbuffer boundaries
    size_t end_offset;
    if (check_add_overflow(cmd->offset, cmd->size, &end_offset)) {
        return -EINVAL;
    }
    if (end_offset > dev_priv->ringbuffer.max_size) {
        return -EINVAL; // Strictly reject out-of-bounds pointer!
    }
    
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

開発現場向けシステム堅牢化チェックリスト

Validate all IOCTL parameters from user-space against strict hardware memory boundary limits.
Use `check_add_overflow` when calculating memory addresses with offsets provided by unprivileged apps.
Confine GPU device file access with restrictive SELinux policies (`allow untrusted_app gpu_device:chr_file`).
Implement hardware memory protection units (IOMMU) to enforce GPU memory isolation.

← セキュリティディレクトリ一覧すべてのセキュリティ更新情報 →