keto0422
Source-scoped identity with 1 associated PoC and 1 linked vulnerability.
Exploit catalog results
Showing 1 PoC on this page
GitHubketo0422/CVE-2023-33107
Repository PoCStars: 7Created 2026-02-05ExploitCVE-2023-331072 files
Analysis
Technical assessment
The artifact is a C exploit for CVE-2023-33107 targeting Qualcomm Snapdragon Graphics Linux. It uses a race condition in the KGSL GPU driver to trigger a use-after-free, corrupt page table entries, and escalate privileges by overwriting the kernel's addr_limit. The code includes GPU command stream programming, task_struct spraying, and shellcode injection to achieve arbitrary kernel read/write and ultimately disable SELinux.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence is a PoC exploit for CVE-2023-33107, a Qualcomm GPU driver vulnerability. The code performs a complex local privilege escalation chain involving GPU memory corruption, kernel memory scanning, and patching of kernel structures (addr_limit, page tables) to achieve arbitrary code execution. All observed behavior is consistent with the disclosed exploit objective. No concealed backdoor, deceptive payload, or unrelated harmful action was identified.
Classification basis and observed behavior
Classification basis
The code actively exploits CVE-2023-33107 by triggering a race condition, corrupting memory, and escalating privileges. It includes shellcode and modifies kernel structures (addr_limit, selinux_enforcing) to achieve its goal, which is characteristic of an exploit.
ex.c:1630ex.c:2093ex.c:1600-1628Requirements
- Access to /dev/kgsl-3d0 device.
ex.c:96 - Ability to execute code on the target device (e.g., via ADB).
ex.c:1631 - A writable directory (/data/local/tmp) for shellcode and temporary files.
ex.c:1672
Observed behavior
- Opens the KGSL device /dev/kgsl-3d0.
ex.c:1707 - Allocates and maps GPU memory objects to set up a use-after-free condition.
ex.c:1713-1763 - Creates a race condition with a thread calling IOCTL_KGSL_MAP_USER_MEM with a wrapping size to corrupt page tables.
ex.c:1600-1628 - Sprays the kernel heap with forked processes whose task_struct contains a marker (KETO0422) to locate them in the UAF region.
ex.c:1925-1992 - Uses GPU command streams (CP_MEM_TO_MEM, CP_MEM_WRITE) to scan the UAF region, locate a target task_struct, and overwrite its addr_limit to KERNEL_DS.
ex.c:557-1147 - Corrupts user-space page table entries (PTEs) via GPU commands to map a chosen physical page into a controlled virtual address.
ex.c:1296-1545 - Maps a shared library (libbase.so) into the corrupted virtual address space and overwrites a function with shellcode.
ex.c:497-519 - Triggers the shellcode execution, which disables SELinux by writing to the selinux_enforcing variable.
ex.c:2093-2111 - Attempts to restore corrupted PTEs after exploitation.
ex.c:204-388
Behaviors behind the backdoor verdict
Observables
- Shellcode
- Payload withheldEmbedded ARM64 shellcode used for the final stage of the exploit. It is written to a file and later copied into a target memory region for execution. This is standard for a local privilege escalation PoC.
ex.c:1630 - File Write
- Payload withheldThe exploit writes the embedded shellcode to a local file for later use. This is a common technique in Android PoCs to stage payloads.
ex.c:1672-1673 - Kernel Memory Manipulation
- Payload withheldThe exploit uses GPU commands to overwrite the addr_limit field of a task_struct in kernel memory, a classic technique to bypass kernel address space restrictions. This is the core of the disclosed vulnerability exploitation.
ex.c:821-876 - Process Spray
- Payload withheldThe exploit forks multiple processes with a specific name to spray the kernel heap with task_structs, making it easier to find and corrupt one via the UAF vulnerability. This is a standard heap spraying technique.
ex.c:1939-1952
What the analysis did not establish
- The evidence includes a complete C source file (ex.c) and a README.md linking to an external writeup and test video. The external links were not followed, and the analysis is based solely on the provided source code.
- The review is limited to the two text files provided. No external dependencies or build scripts were analyzed.
- The shellcode is provided as a raw byte array and was not disassembled, but its use is consistent with the final stage of the exploit.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.