● CVE-2024-33066 / Commercial Spyware Zero-Day

CVE-2024-33066: Qualcomm Adreno GPU Kernel Memory Corruption Teardown

How an unchecked ring-buffer boundary read in Qualcomm's kgsl GPU driver allowed targeted mobile spyware to corrupt Android kernel memory.

💡 Explicação em Linguagem Simples (ELI5)

Imagine a scoreboard operator at a stadium who reads game scores from a paper tape. An attacker sends a tape that says 'Jump 500 lines forward and read the score'. The operator blindly jumps off the edge of the paper into the stadium's electrical wiring diagram, reading and overwriting the master power switches.

Conceitos Centrais e Termos do Subsistema

Qualcomm KGSL: Kernel Graphics Support Layer: Qualcomm's proprietary driver mediating user-space graphics commands to Adreno GPU cores.
Ring Buffer: A circular memory buffer where the CPU writes commands for the GPU to consume asynchronously.
Out-of-Bounds Write: Writing data past the end of the memory buffer designated for GPU command descriptors.
SELinux Untrusted App Domain: The default restricted security domain where standard Android third-party apps execute.

Mecânica de Execução Passo a Passo

Step 1

1. Open KGSL Device

An untrusted app opens /dev/kgsl-3d0.

Step 2

2. Submit Crafted Command Batch

The app submits a IOCTL_KGSL_GPU_COMMAND payload with a forged command packet offset.

Step 3

3. Unchecked Pointer Arithmetic

The driver adds the offset to the ring-buffer base without validating the maximum command length.

Step 4

4. Kernel Memory Overwrite

The GPU executes the command, writing memory across adjacent kernel heap structures.

Código Fonte: Falha Fatal vs. Correção Segura

Apresentado em código-fonte legível de alto nível (sem assembly bruto ou diffs binários).

FALHA NÃO CORRIGIDA

// VULNERABLE: drivers/gpu/msm/kgsl.c before patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // ROOT CAUSE:
    // Adds user-controlled offset to ringbuffer without boundary bounds verification!
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    
    // Writes user command directly into arbitrary memory!
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

PATCH PROTEGIDO

// SECURE: drivers/gpu/msm/kgsl.c patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // 1. Validate that offset and size do not overflow ringbuffer boundaries
    size_t end_offset;
    if (check_add_overflow(cmd->offset, cmd->size, &end_offset)) {
        return -EINVAL;
    }
    if (end_offset > dev_priv->ringbuffer.max_size) {
        return -EINVAL; // Strictly reject out-of-bounds pointer!
    }
    
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

Checklist de Engenharia e Proteção de Sistemas

Validate all IOCTL parameters from user-space against strict hardware memory boundary limits.
Use `check_add_overflow` when calculating memory addresses with offsets provided by unprivileged apps.
Confine GPU device file access with restrictive SELinux policies (`allow untrusted_app gpu_device:chr_file`).
Implement hardware memory protection units (IOMMU) to enforce GPU memory isolation.

← Navegar no Diretório de Segurança Todas as Atualizações de Segurança →