DEF CON 32 - The Way To Android Root: Exploiting Smartphone GPU - Xiling Gong, Eugene Rodionov

This presentation demonstrates how the Android Red Team discovered and exploited CVE-2024-23380, a vulnerability in Qualcomm Adreno GPU drivers that allowed them to gain root privileges on Android devices 9:35-9:57.

Key Takeaways:
• GPU drivers are attractive attack targets because applications don't need special permissions to access them, providing a direct attack surface to untrusted code 1:19-2:14
• The vulnerability was a race condition in the virtual buffer object (VBO) binding process where physical-to-virtual mapping occurred outside of a protected lock section 19:13-19:23
• By triggering the race condition with two threads (one binding, one unbinding), they could create a use-after-free condition allowing access to freed physical pages 21:04-21:26
• The exploit involved spraying kernel memory with specially crafted structures, modifying physical addresses to point to kernel memory, and mapping the entire kernel to user space 30:26-31:23
• The team demonstrated the exploit on a smartphone with Snapdragon Generation 8, successfully gaining root access 39:17-39:23

The team discovered this vulnerability through manual code review and patch analysis, suggesting that moving GPU processing to an out-of-process model and using memory-safe languages could improve Android security.

Sources:

• 1:19-2:14 Explanation of why GPU drivers are attractive security targets
• 19:13-19:23 Technical details of the VBO binding vulnerability
• 21:04-21:26 Explanation of the race condition tri