Following our announcement on the N-Days Exploit Acquisition Program for smartphones, we are delighted to share the first couple of submissions. We received many submissions and we’re in the process of sharing them with ZHA followed by a public disclosure. We plan to release additional EOPs, RCEs and Infoleaks purchased through Zimperium N-Days EAP in the next few months. If you have a mobile N-Day exploit that you would like to monetize, or would like to practice on exploitation and get paid for it – check out the submission guidelines in our N-Days Exploit Acquisition Program announcement. We encourage all partners of ZHA to share exploit submissions for better collaboration between all those involved in making our mobile devices safer.
Download Exploit (password zimperium_ndays)
Vulnerable file drivers/gpu/nvgpu/gk20a/channel_gk20a.c
When we perform an IOCTL operation on /dev/nvhost-gpu with cmd NVHOST_IOCTL_CHANNEL_SET_ERROR_NOTIFIER it calls function gk20a_init_error_notifier. This function does not validate args->offset from userspace leading to elevation of privileges to the context of the kernel.
| static int gk20a_init_error_notifier(struct channel_gk20a *ch, |
| struct nvhost_set_error_notifier *args) { |
| void *va; |
| struct dma_buf *dmabuf; |
| if (!args->mem) { |
| pr_err("gk20a_init_error_notifier: invalid memory handle\n"); |
| return -EINVAL; |
| } |
| dmabuf = dma_buf_get(args->mem); |
| if (ch->error_notifier_ref) |
| gk20a_free_error_notifiers(ch); |
| if (IS_ERR(dmabuf)) { |
| pr_err("Invalid handle: %d\n", args->mem); |
| return -EINVAL; |
| } |
| /* map handle */ |
| va = dma_buf_vmap(dmabuf); |
| if (!va) { |
| dma_buf_put(dmabuf); |
| pr_err("Cannot map notifier handle\n"); |
| return -ENOMEM; |
| } |
| /* set channel notifiers pointer */ |
| ch->error_notifier_ref = dmabuf; |
| ch->error_notifier = va + args->offset; |
| ch->error_notifier_va = va; |
| memset(ch->error_notifier, 0, sizeof(struct nvhost_notification)); |
| return 0; |
| } |