flawopen.com/Teardowns/cve-2023-4211-arm-mali-gpu-kernel-race-condition

● CVE-2023-4211 · CVSS 5.5 · 中危
安全研究 · FlawOpen

深度技术拆解：CVE-2023-4211: Arm Mali GPU Kernel Memory Race Condition Teardown

CVE-2023-4211 源代码级技术深度解析与系统加固工程指南：深入剖析漏洞触发条件、攻击利用链条与加固补丁的具体实现。

💡 通俗易懂的原理解析 (ELI5)

通俗原理解析：Imagine a hotel where guests return room keys to the front desk. A dishonest guest hands in their key, and while the clerk is marking the room empty in the computer, the guest's accomplice runs into the room, replaces the door lock with their own, and starts renting out the room privately without the hotel knowing.

核心概念与专有名词

Mali kbase Driver
The Linux kernel module interfacing Arm Mali GPU cores with user-space rendering libraries.
Page Table Mapping (mmap)
Mapping GPU hardware physical memory pages into user-space process virtual memory addresses.
Race Condition
A timing bug where two execution threads attempt to access and modify shared resources simultaneously without adequate synchronization.
Privilege Escalation
Gaining kernel execution privileges from an unprivileged sandbox application.

根本原因剖析 (Root Cause)

根本原因在于开源系统中未经验证的边界参数，导致状态不同步并绕过安全控制。

攻击执行流程分解

Step 1

攻击阶段剖析：Multi-Threaded Memory Allocation

技术利用机制与执行路径分析：The attacker launches two threads mapping GPU memory chunks via mmap().

Step 2

攻击阶段剖析：Race Unmap Against Access

技术利用机制与执行路径分析：Thread A invokes munmap() while Thread B simultaneously queues GPU drawing commands on the same region.

Step 3

攻击阶段剖析：Free Memory Access

技术利用机制与执行路径分析：The kernel frees the memory pages, but Thread B's GPU commands execute against the freed pages.

Step 4

攻击阶段剖析：Kernel Control Hijack

技术利用机制与执行路径分析：The attacker sprays page tables into the slot, rewriting GPU descriptors to access all physical device RAM.

源代码对比：漏洞与安全实现

存在漏洞的实现
// VULNERABLE: drivers/gpu/arm/midgard/mali_kbase_mem.c
int kbase_mem_free(struct kbase_context *kctx, u64 gpu_addr) {
    struct kbase_va_region *reg = kbase_region_tracker_find(kctx, gpu_addr);
    
    // ROOT CAUSE:
    // Memory region is unmapped and freed WITHOUT holding the context's page lock!
    // Concurrent GPU commands can still dereference 'reg' while it is being destroyed!
    kbase_gpu_vm_lock(kctx);
    kbase_mem_free_region(kctx, reg); // Frees underlying pages
    kbase_gpu_vm_unlock(kctx);
    return 0;
}
加固后的安全修复
// SECURE: drivers/gpu/arm/midgard/mali_kbase_mem.c patch
int kbase_mem_free(struct kbase_context *kctx, u64 gpu_addr) {
    // 1. Acquire global context lock BEFORE looking up region
    kbase_gpu_vm_lock(kctx);
    
    struct kbase_va_region *reg = kbase_region_tracker_find(kctx, gpu_addr);
    if (!reg) {
        kbase_gpu_vm_unlock(kctx);
        return -EINVAL;
    }
    
    // 2. Wait for all in-flight GPU job chains to complete before deallocating
    kbase_wait_for_in_flight_jobs(kctx, reg);
    
    kbase_mem_free_region(kctx, reg);
    kbase_gpu_vm_unlock(kctx);
    return 0;
}

工程与系统安全加固清单

参考来源