● CVE-2024-33066 / Commercial Spyware Zero-Day

CVE-2024-33066: Qualcomm Adreno GPU Kernel Memory Corruption Teardown

How an unchecked ring-buffer boundary read in Qualcomm's kgsl GPU driver allowed targeted mobile spyware to corrupt Android kernel memory.

💡 通俗通俗化解析 (ELI5)

Imagine a scoreboard operator at a stadium who reads game scores from a paper tape. An attacker sends a tape that says 'Jump 500 lines forward and read the score'. The operator blindly jumps off the edge of the paper into the stadium's electrical wiring diagram, reading and overwriting the master power switches.

核心概念与底层架构术语

Qualcomm KGSL: Kernel Graphics Support Layer: Qualcomm's proprietary driver mediating user-space graphics commands to Adreno GPU cores.
Ring Buffer: A circular memory buffer where the CPU writes commands for the GPU to consume asynchronously.
Out-of-Bounds Write: Writing data past the end of the memory buffer designated for GPU command descriptors.
SELinux Untrusted App Domain: The default restricted security domain where standard Android third-party apps execute.

攻击利用全流程逐步拆解

Step 1

1. Open KGSL Device

An untrusted app opens /dev/kgsl-3d0.

Step 2

2. Submit Crafted Command Batch

The app submits a IOCTL_KGSL_GPU_COMMAND payload with a forged command packet offset.

Step 3

3. Unchecked Pointer Arithmetic

The driver adds the offset to the ring-buffer base without validating the maximum command length.

Step 4

4. Kernel Memory Overwrite

The GPU executes the command, writing memory across adjacent kernel heap structures.

源码对比：致命缺陷 vs. 加固补丁

采用清晰易读的高级编程语言展示（不含晦涩汇编或二进制机器码）。

未修补缺陷代码

// VULNERABLE: drivers/gpu/msm/kgsl.c before patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // ROOT CAUSE:
    // Adds user-controlled offset to ringbuffer without boundary bounds verification!
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    
    // Writes user command directly into arbitrary memory!
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

安全加固补丁

// SECURE: drivers/gpu/msm/kgsl.c patch
int kgsl_ioctl_gpu_command(struct kgsl_device_private *dev_priv, void *data) {
    struct kgsl_gpu_command *cmd = data;
    
    // 1. Validate that offset and size do not overflow ringbuffer boundaries
    size_t end_offset;
    if (check_add_overflow(cmd->offset, cmd->size, &end_offset)) {
        return -EINVAL;
    }
    if (end_offset > dev_priv->ringbuffer.max_size) {
        return -EINVAL; // Strictly reject out-of-bounds pointer!
    }
    
    void *cmd_ptr = dev_priv->ringbuffer.base + cmd->offset;
    memcpy(cmd_ptr, cmd->commands, cmd->size);
    return 0;
}

工程落地与系统加固清单

Validate all IOCTL parameters from user-space against strict hardware memory boundary limits.
Use `check_add_overflow` when calculating memory addresses with offsets provided by unprivileged apps.
Confine GPU device file access with restrictive SELinux policies (`allow untrusted_app gpu_device:chr_file`).
Implement hardware memory protection units (IOMMU) to enforce GPU memory isolation.

← 浏览完整安全目录所有平台安全更新 →