CVE-2023-21666

Related Files

Qualcomm Adreno/KGSL Data Leakage

Posted May 31, 2023

Authored by Jann Horn, Google Security Research

On Qualcomm Adreno/KGSL builds where CONFIG_QCOM_KGSL_USE_SHMEM is not set (or on older KGSL versions without CONFIG_QCOM_KGSL_USE_SHMEM), KGSL allocates GPU-shared memory from its own page pool. Pages from this pool are inserted into VMAs that don't have any weird flags like VM_PFNMAP set, which means userspace can grab extra references to these pages through get_user_pages() (for example, using vmsplice()). But when GPU-shared memory is freed, KGSL puts the freed pages into its own page pool without checking the page refcount. This means that pages that are still accessible from userspace can be reallocated as GPU memory by another process.

tags | exploit

advisories | CVE-2023-21666

SHA-256 | 912899972d766ddbe72f5a9e3255c982b1f4d47a09b7d4e6f29f8440583aa47c

Download | Favorite | View