● CVE-2024-33066 / Commercial Spyware Zero-Day

CVE-2024-33066: Qualcomm Adreno GPU Kernel Memory Corruption Teardown

How an unchecked ring-buffer boundary read in Qualcomm's kgsl GPU driver allowed targeted mobile spyware to corrupt Android kernel memory.

💡 Простое объяснение на пальцах (ELI5)

Imagine a scoreboard operator at a stadium who reads game scores from a paper tape. An attacker sends a tape that says 'Jump 500 lines forward and read the score'. The operator blindly jumps off the edge of the paper into the stadium's electrical wiring diagram, reading and overwriting the master power switches.

Ключевые концепции и архитектурные термины

Qualcomm KGSL: Kernel Graphics Support Layer: Qualcomm's proprietary driver mediating user-space graphics commands to Adreno GPU cores.
Ring Buffer: A circular memory buffer where the CPU writes commands for the GPU to consume asynchronously.
Out-of-Bounds Write: Writing data past the end of the memory buffer designated for GPU command descriptors.
SELinux Untrusted App Domain: The default restricted security domain where standard Android third-party apps execute.

Пошаговая механика выполнения атаки

Step 1

1. Open KGSL Device

An untrusted app opens /dev/kgsl-3d0.

Step 2

2. Submit Crafted Command Batch

The app submits a IOCTL_KGSL_GPU_COMMAND payload with a forged command packet offset.

Step 3

3. Unchecked Pointer Arithmetic

The driver adds the offset to the ring-buffer base without validating the maximum command length.

Step 4

4. Kernel Memory Overwrite

The GPU executes the command, writing memory across adjacent kernel heap structures.

Исходный код: Уязвимость vs. Исправленный патч

Представлено на понятном высокоуровневом исходном коде (без ассемблера и бинарных дампов).

УЯЗВИМЫЙ КОД ДО ПАТЧА

// VULNERABLE: drivers/gpu/msm/kgsl.c before patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // ROOT CAUSE:
    // Adds user-controlled offset to ringbuffer without boundary bounds verification!
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    
    // Writes user command directly into arbitrary memory!
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

БЕЗОПАСНОЕ ИСПРАВЛЕНИЕ

// SECURE: drivers/gpu/msm/kgsl.c patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // 1. Validate that offset and size do not overflow ringbuffer boundaries
    size_t end_offset;
    if (check_add_overflow(cmd->offset, cmd->size, &end_offset)) {
        return -EINVAL;
    }
    if (end_offset > dev_priv->ringbuffer.max_size) {
        return -EINVAL; // Strictly reject out-of-bounds pointer!
    }
    
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

Инженерный чек-лист для код-ревью и защиты систем

Validate all IOCTL parameters from user-space against strict hardware memory boundary limits.
Use `check_add_overflow` when calculating memory addresses with offsets provided by unprivileged apps.
Confine GPU device file access with restrictive SELinux policies (`allow untrusted_app gpu_device:chr_file`).
Implement hardware memory protection units (IOMMU) to enforce GPU memory isolation.

← Полный каталог уязвимостей Все бюллетени безопасности →