CVE-2016-2067 PoC — Android Qualcomm GPU驱动提权漏洞

Source

https://github.com/hhj4ck/CVE-2016-2067

Associated Vulnerability

Title:Android Qualcomm GPU驱动提权漏洞 (CVE-2016-2067)
Description:drivers/gpu/msm/kgsl.c in the MSM graphics driver (aka GPU driver) for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, mishandles the KGSL_MEMFLAGS_GPUREADONLY flag, which allows attackers to gain privileges by leveraging accidental read-write mappings, aka Qualcomm internal bug CR988993.

Readme

# ADRENO GPU IOMMU DMA EXPLOIT

Tested under Nexus 6p (google/angler/angler:6.0.1/MMB29M/2431559:user/release-keys)

# About the bug

Discussed in 2016 via [Blackhat EU](https://www.blackhat.com/docs/eu-16/materials/eu-16-Taft-GPU-Security-Exposed.pdf)

# About the exploit

With iommu dma writes, vdso.so is overwritten with shellcode.

So after /init executes __kernel_clock_gettime, the shellcode will get executed.

/init process then connect back with a root shell.

# Logs
```
Reverse shell target: 127.0.0.1:4919
shellcode patch done
hook patch done
Waiting for reverse connect shell...
TERMINAL>>>
id
uid=0(root) gid=0(root) groups=0(root) context=u:r:init:s0
```

# Tips

Delete /data/local/tmp/x if any before the exploit.

If the waiting time is too long, try open "Time and Date" options inside the settings of your phone.

# Porting to other devices

Check the verison of adreno, currently it is built for 4xx.

For 5xx and above:
 - use cp_type7_packet instead of cp_type3_packet
 - use IOCTL_KGSL_GPU_COMMAND instead of IOCTL_KGSL_RINGBUFFER_ISSUEIBCMDS

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →