CVE-2023-33107

Classification basis

The code actively exploits CVE-2023-33107 by triggering a race condition, corrupting memory, and escalating privileges. It includes shellcode and modifies kernel structures (addr_limit, selinux_enforcing) to achieve its goal, which is characteristic of an exploit.

Requirements

• Access to /dev/kgsl-3d0 device.ex.c:96
• Ability to execute code on the target device (e.g., via ADB).ex.c:1631
• A writable directory (/data/local/tmp) for shellcode and temporary files.ex.c:1672

Observed behavior

• Opens the KGSL device /dev/kgsl-3d0.ex.c:1707
• Allocates and maps GPU memory objects to set up a use-after-free condition.ex.c:1713-1763
• Creates a race condition with a thread calling IOCTL_KGSL_MAP_USER_MEM with a wrapping size to corrupt page tables.ex.c:1600-1628
• Sprays the kernel heap with forked processes whose task_struct contains a marker (KETO0422) to locate them in the UAF region.ex.c:1925-1992
• Uses GPU command streams (CP_MEM_TO_MEM, CP_MEM_WRITE) to scan the UAF region, locate a target task_struct, and overwrite its addr_limit to KERNEL_DS.ex.c:557-1147
• Corrupts user-space page table entries (PTEs) via GPU commands to map a chosen physical page into a controlled virtual address.ex.c:1296-1545
• Maps a shared library (libbase.so) into the corrupted virtual address space and overwrites a function with shellcode.ex.c:497-519
• Triggers the shellcode execution, which disables SELinux by writing to the selinux_enforcing variable.ex.c:2093-2111
• Attempts to restore corrupted PTEs after exploitation.ex.c:204-388

Observables

Shellcode

Payload withheldEmbedded ARM64 shellcode used for the final stage of the exploit. It is written to a file and later copied into a target memory region for execution. This is standard for a local privilege escalation PoC.ex.c:1630

File Write

Payload withheldThe exploit writes the embedded shellcode to a local file for later use. This is a common technique in Android PoCs to stage payloads.ex.c:1672-1673

Kernel Memory Manipulation

Payload withheldThe exploit uses GPU commands to overwrite the addr_limit field of a task_struct in kernel memory, a classic technique to bypass kernel address space restrictions. This is the core of the disclosed vulnerability exploitation.ex.c:821-876

Process Spray

Payload withheldThe exploit forks multiple processes with a specific name to spray the kernel heap with task_structs, making it easier to find and corrupt one via the UAF vulnerability. This is a standard heap spraying technique.ex.c:1939-1952