Evils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs
No ratings
Presented at BlackHat Europe 2023 by
The center of Android games' graphics stack are userspace proprietary vendor-specific libraries that implement various graphics APIs. To further understand how these middleware libraries work and communicate with the low-level GPU device drivers and firmwares, we built an instrumentation framework that can trace the host memory-related syscalls and driver IOCTL calls. Graphic APIs are closely tied with memory management between the CPU and GPU under the hood. This led us to ask several questions, such as what happens if an undefined behavior occurs when an internal function fails unexpectedly?Our research revealed a number of GPU driver bugs. The worst bugs, which existed for about a decade, occur in the GPU sparse texture memory feature. This feature was designed to reduce the usage of physical memory pages by allowing a resource to appear to consume a number of virtual pages, while only a small number of physical pages are actually allocated. However, not all GPU vendors implement this feature correctly and acknowledge the undefined behaviors of the sparse texture documented in the Khronos OpenGL documentations. Such behaviors may eventually lead to physical page Use After Free (UAF).In this talk, we will demonstrate vulnerabilities in the Imagination Technologies' PowerVR GPU, which is used in a wide range of Android devices. We have discovered several physical page UAF vulnerabilities, most of which are caused by the mishandled sparse texture memory management. Specifically, a malicious actor can manipulate arbitrary freed physical pages from the CPU side using OpenGL or from the GPU side using OpenCL. Unlike typical device driver exploits which heavily rely on driver IOCTL calls, a malicious actor can exploit the vulnerability using only OpenGL APIs plus an extra mmap function. This could make the exploit code harder to detect from the static analysis point of view due to the absence of direct interaction with the vulnerable drivers. Additionally, we will articulate the solutions for detecting these exploits and show a demo of rooting a device.We will provide details of the vulnerabilities' disclosure timeline. We hope that this talk will raise awareness of these vulnerabilities and help to mitigate the risk of exploitation, as these findings may potentially kill some in the wild exploit chains.