CVE-2021-28663 PoC — ARM Mali GPU 资源管理错误漏洞

Source

https://github.com/lntrx/CVE-2021-28663

Associated Vulnerability

Title: ARM Mali GPU 资源管理错误漏洞 (CVE-2021-28663)
Description:The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-after-free. This affects Bifrost r0p0 through r28p0 before r29p0, Valhall r19p0 through r28p0 before r29p0, and Midgard r4p0 through r30p0.

Description

A basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)

Readme

# CVE-2021-28663
A basic PoC leak for CVE-2021-28663 (Internal of the Android kernel backdoor vulnerability)

This is a basic PoC for CVE-2021-28663. A design flaw in Mali GPU Android Kernel Driver.

1. Create a `GPU_VA` and also `mmap` to it so we can get virtual addr for phys pages.
2. Create an alias for phy pages, but don't do `mmap` so `gpu_mapping` remains as 1
3. Change flags of `GPU_VA` to `BASE_MEM_DONT_NEED`. Mali will make them evictable
4. Since we have `reg` for aliased page, now we can `mmap` to it. This will give us RDONLY access from CPU

## Example run:

![Example run CVE-2021-28663](ss/1.png)

![Example run CVE-2021-28663](ss/2.png)

![Example run CVE-2021-28663](ss/3.png)

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →