Evils in the Sparse Texture Memory: Exploit Kernel Based on Undefined Behaviors of Graphic APIs
summary
Finds multiple physical-page use-after-free bugs in Imagination Technologies PowerVR GPU sparse texture handling, outlines how mishandled PMR/PMR refcounts and incorrect GPU virtual-address checks let attackers free and remap pages. Exploit path uses only OpenGL + mmap (no IOCTLs) or OpenCL to manipulate freed pages, yields reliable read/write of arbitrary physical memory, and shows a live demo that roots a device in ~10 seconds; includes detection ideas and hardening fixes.
AI-written summary · about
chapters (10)
- 0:00Introduction to android security
- 1:08Android gpu driver landscape
- 5:19Graphic stack architecture
- 10:46Fuzzing for gpu vulnerabilities
- 14:23Spot texture vulnerabilities
- 20:53Driver exploitation techniques
- 25:53Device rooting and patching
- 29:01Defensive research strategies
- 33:25Mitigation and detection
- 35:37Partner vulnerability program
related talks
51mExploiting Hardware Glitches And Side Channels In Perfect Software
33mExploring a New Class of Kernel Exploit Primitive
33mAI Accelerated Exploiting: Compromising MTE Enabled Pixel from DSP Coprocessor
22mHunting and Exploiting Recursive MMIO Flaws in QEMU KVM
36mLost Control-Breaking Hardware-Assisted Kernel Control-Flow Integrity with Page-Oriented Programming
41mUsing Microarchitectural Design to Break KASLR and More
19mDisARMed: Attacking ARM TrustZone from Userspace with Memory Aliasing
25mOne Bit Flips, One Cloud Flops: Cross-VM Row Hammer Attacks...