Qualcomm has issued patches for the vulnerabilities, but security experts recommend users update their devices immediately as attackers could potentially exploit these flaws to gain complete control of affected devices, access sensitive data, and install persistent malware. Their technique, dubbed “GPUAF” (GPU Use-After-Free), chains multiple vulnerabilities in Qualcomm’s GPU drivers to achieve complete system control across devices from Samsung, Xiaomi, Honor, and Vivo. The researchers detailed three critical flaws: CVE-2024-23380, a race condition in the Kgsl VBO map buffer; CVE-2024-23373, a page Use-After-Free vulnerability triggered when unmap operations fail; and a third bug involving premature page table entry destruction. GPUAF represents a significant advancement in Android exploitation, demonstrating how GPU driver vulnerabilities can be chained to achieve full device compromise-and underscoring the need for robust, multi-layered mobile security defenses. The attack affects numerous devices including Samsung Galaxy S series (non-Exynos chips), Honor phones (x9b, 90…), Xiaomi phones (14, 14 Pro, Redmi Note 13 Pro…), and Vivo phones (iQOO Z9s Pro, T3 Pro…). “What makes this attack particularly concerning is its broad applicability across vendors and its ability to bypass hardware-backed security measures,” noted the researchers. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The researchers also demonstrated bypasses for advanced security features like Samsung’s Enhanced SELinux and KNOX hypervisor protections that operate at EL2 (Exception Level 2). The exploit deliberately races two bind operations to cause the GPU driver to incorrectly track memory mappings, eventually leading to a situation where freed memory pages remain accessible through the GPU. After gaining control of page tables, attackers can disable SELinux by overwriting the selinux_state structure and gaining root privileges.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 29 Apr 2025 11:25:08 +0000