"Arm Vulnerability Leads to Code Execution, Root on Pixel 6 Phones"

A security researcher recently published technical details on an Arm Mali GPU vulnerability leading to arbitrary kernel code execution and root on Pixel 6 phones using a malicious app installed on the targeted device.  The vulnerability is tracked as CVE-2022-38181 (CVSS score of 8.8).  The issue is described as a use-after-free bug that impacts Arm Mali GPU driver versions prior to r40p0 (released on October 7, 2022).  The researcher stated that the issue is related to a special function for sending "job chains" to the GPU, which also supports jobs implemented in the kernel, which run on the CPU instead (which are called software jobs or softjobs).  The researcher noted that due to the complexity involved in managing memory sharing between user space applications and the GPU, many of the vulnerabilities in the Arm Mali GPU involve the memory management code.  The current vulnerability is another example of this and involves a special type of GPU memory: the JIT memory.  The researcher noted that some of the softjobs instruct the kernel to allocate and free JIT memory, and CVE-2022-38181 is related to these: malicious code can be used to add a JIT memory region to an eviction list, then create memory pressure to trigger a vulnerable eviction function, resulting in the JIT region being freed without freeing the pointer.  The researcher discovered that a freed JIT region could be replaced with a fake object, which could be used to potentially free arbitrary pages and then exploit these to gain read and write access to arbitrary memory.  As a final step in exploiting the vulnerability, an attacker would need to "map kernel code to the GPU address space to gain arbitrary kernel code execution, which can then be used to rewrite the credentials of our process to gain root, and to disable SELinux." The researcher reported the vulnerability to the Android security team in July 2022, along with proof-of-concept (PoC) code demonstrating how the issue can be exploited to execute code and gain root access on Pixel 6.  Initially, the Android team marked the flaw "high severity," but it then informed the researcher that no patch will be released and redirected the report to the Arm team.  After Arm's patch in October 2022, Google included a fix for this vulnerability in the January 2023 security update for Pixel devices.  

SecurityWeek reports: "Arm Vulnerability Leads to Code Execution, Root on Pixel 6 Phones"