Who cares about GPUs?
You, me, and your complete ecosystem! GPUs (graphics processing items) are important in delivering wealthy visible experiences on cellular gadgets. Nevertheless, the GPU software program and firmware stack has develop into a manner for attackers to realize permissions and entitlements (privilege escalation) to Android-based gadgets. There are many points on this class that may have an effect on all main GPU manufacturers, for instance, CVE-2023-4295, CVE-2023-21106, CVE-2021-0884, and extra. Most exploitable GPU vulnerabilities are within the implementation of the GPU kernel mode modules. These modules are items of code that load/unload throughout runtime, extending performance with out the necessity to reboot the gadget.
Proactive testing is sweet hygiene as it might probably result in the detection and backbone of recent vulnerabilities earlier than they’re exploited. It’s additionally one of the vital advanced investigations to do as you don’t essentially know the place the vulnerability will seem (that’s the purpose!). By combining the experience of Google’s engineers with IP homeowners and OEMs, we are able to make sure the Android ecosystem retains a robust measure of integrity.
Why examine GPUs?
When researching vulnerabilities, GPUs are a preferred goal attributable to:
- Performance vs. Safety Tradeoffs
No person needs a sluggish, unresponsive gadget; any hits to GPU efficiency might lead to a noticeably degraded consumer expertise. As such, the GPU software program stack in Android depends on an in-process HAL mannequin the place the API & consumer area drivers speaking with the GPU kernel mode module are working straight throughout the context of apps, thus avoiding IPC (interprocess communication). This opens the door for doubtlessly untrusted code from a 3rd occasion app having the ability to straight entry the interface uncovered by the GPU kernel module. If there are any vulnerabilities within the module, the third occasion app has an avenue to use them. In consequence, a doubtlessly untrusted code working within the context of the third occasion software is ready to straight entry the interface uncovered by the GPU kernel module and exploit potential vulnerabilities within the kernel module.
- Selection & Reminiscence Security
Moreover, the implementation of GPU subsystems (and kernel modules particularly) from main OEMs are more and more advanced. Kernel modules for many GPUs are sometimes written in reminiscence unsafe languages similar to C, that are prone to reminiscence corruption vulnerabilities like buffer overflow.
Can somebody do one thing about this?
Nice information, we have already got! Who’s we? The Android Crimson Crew and Arm! We’ve labored collectively to run an engagement on the Mali GPU (extra on that under), however first, a quick introduction:
Android Crimson Crew
The Android Crimson Crew performs time-bound safety evaluation engagements on all elements of the Android open supply codebase and conducts common safety critiques and assessments of inside Android elements. All through these engagements, the Android Crimson Crew frequently collaborates with third occasion software program and {hardware} suppliers to research and perceive proprietary and “closed supply” code repositories and related supply code which can be utilized by Android merchandise with the only real goal to determine safety dangers and potential vulnerabilities earlier than they are often exploited by adversaries exterior of Android. This yr, the Android Crimson Crew collaborated straight with our trade accomplice, Arm, to conduct the Mali GPU engagement and additional safe tens of millions of Android gadgets.
Arm Product Safety and GPU Groups
Arm has a central product safety crew that units the coverage and observe throughout the corporate. Additionally they have devoted product safety specialists embedded in engineering groups. Arm operates a scientific strategy which is designed to forestall, uncover, and remove safety vulnerabilities. This features a Safety Improvement Lifecycle (SDL), a Monitoring functionality, and Incident Response. For this collaboration the Android Crimson Groups had been supported by the embedded safety specialists based mostly in Arm’s GPU engineering crew.
Working collectively to safe Android gadgets
Google’s Android Safety groups and Arm have been working collectively for a very long time. Safety necessities are by no means static, and challenges exist with all GPU distributors. By ceaselessly sharing experience, the Android Crimson Crew and Arm had been capable of speed up detection and backbone. Investigations of recognized vulnerabilities, potential remediation methods, and hardening measures drove detailed analyses and the implementation of fixes the place related.
Current analysis targeted on the Mali GPU as a result of it’s the most well-liked GPU in at present’s Android gadgets. Collaborating on GPU safety allowed us to:
- Assess the impression on the broadest section of the Android Ecosystem: The Arm Mali GPU is likely one of the most used GPUs by unique tools producers (OEMs) and is discovered in lots of standard cellular gadgets. By specializing in the Arm Mali GPU, the Android Crimson Crew might assess the safety of a GPU implementation working on tens of millions of Android gadgets worldwide.
- Consider the reference implementation and vendor-specific adjustments: Cellphone producers typically modify the upstream implementation of GPUs. This tailors the GPU to the producer’s particular gadget(s). These modifications and enhancements are at all times difficult to make, and might typically introduce safety vulnerabilities that aren’t current within the unique model of the GPU upstream. On this particular occasion, the Google Pixel crew actively labored with the Android Crimson Crew to higher perceive and safe the modifications they made for Pixel gadgets.
Enhancements
Investigations have led to important enhancements, leveling up the safety of the GPU software program/firmware stack throughout a large section of the Android ecosystem.
Testing the kernel driver
One key part of the GPU subsystem is its kernel mode driver. Throughout this engagement, each the Android Crimson Crew and Arm invested important effort trying on the Mali kbase kernel driver. On account of its complexity, fuzzing was chosen as the first testing strategy for this space. Fuzzing automates and scales vulnerability discovery in a manner not doable by way of guide strategies. With assist from Arm, the Android Crimson Crew added extra syzkaller fuzzing descriptions to match the newest Mali kbase driver implementation.
The crew constructed just a few customizations to allow fuzzing the Mali kbase driver within the cloud, with out bodily {hardware}. This offered an enormous enchancment to fuzzing efficiency and scalability. With the Pixel crew’s assist, we additionally had been capable of arrange fuzzing on precise Pixel gadgets. By means of the mix of cloud-based fuzzing, Pixel-based fuzzing, and guide evaluation, we had been capable of uncover two reminiscence points in Pixel’s customization of driver code (CVE-2023-48409 and CVE-2023-48421).
Each points occurred within the gpu_pixel_handle_buffer_liveness_update_ioctl operate, which is carried out by the Pixel crew as a part of gadget particular customization. These are each reminiscence points attributable to integer overflow issues. If exploited fastidiously alongside different vulnerabilities, these points might result in kernel privilege escalation from consumer area. Each points had been mounted and the patch was launched to affected gadgets in Pixel safety bulletin 2023-12-01.
Testing the firmware
Firmware is one other basic constructing block of the GPU subsystem. It’s the middleman working with kernel drivers and GPU {hardware}. In lots of circumstances, firmware performance is straight/not directly accessible from the appliance. So “software ⇒ kernel ⇒ firmware ⇒ kernel” is a identified assault circulation on this space. Additionally, on the whole, firmware runs on embedded microcontrollers with restricted sources. Generally used safety kernel mitigations (ASLR, stack safety, heap safety, sure sanitizers, and so on.) won’t be relevant to firmware attributable to useful resource constraints and efficiency impression. This may make compromising firmware simpler, in some circumstances, than straight compromising kernel drivers from consumer area. To check the integrity of present firmware, the Android Crimson Crew and Arm labored collectively to carry out each fuzzing and formal verification together with guide evaluation. This multi-pronged strategy led to the invention of CVE-2024-0153, which had a patch launched in the July 2024 Android Safety Bulletin.
CVE-2024-0153 occurs when GPU firmware handles sure directions. When dealing with such directions, the firmware copies register content material right into a buffer. There are measurement checks earlier than the copy operation. Nevertheless, beneath very particular circumstances, an out-of-bounds write occurs to the vacation spot buffer, resulting in a buffer overflow. When fastidiously manipulated, this overflow will overwrite another vital constructions following the buffer, inflicting code execution within the GPU firmware.
The circumstances obligatory to achieve and doubtlessly exploit this concern are very advanced because it requires a deep understanding of how directions are executed. With collective experience, the Android Crimson Crew and Arm had been capable of confirm the exploitation path and leverage the problem to realize restricted management of GPU firmware. This ultimately circled again to the kernel to acquire privilege escalation. Arm did a wonderful job to reply rapidly and remediate the problem. Altogether, this highlights the power of collaboration between each groups to dive deeper.
Time to Patch
It’s identified that attackers exploit GPU vulnerabilities within the wild, and time to patch is essential to cut back threat of exploitation and defend customers. On account of this engagement, 9 new Safety Take a look at suite (STS) exams had been constructed to assist companions routinely examine their builds for lacking Mali kbase patches. (Safety Take a look at Suite is software program offered by Google to assist companions automate the method of checking their builds for lacking safety patches.)
What’s Subsequent?
The Arm Product Safety Crew is actively concerned in security-focused trade communities and collaborates intently with its ecosystem companions. The engagement with the Android Crimson Crew, as an illustration, gives helpful enablement that drives finest practices and product excellence. Constructing on this collaborative strategy, Arm is complementing its product safety assurance capabilities with a bug bounty program. This funding will increase Arm’s efforts to determine potential vulnerabilities. For extra data on Arm’s product safety initiatives, please go to this product safety web page.
The Android Crimson Crew and Arm proceed to work collectively to proactively elevate the bar on GPU safety. With thorough testing, speedy fixing, and updates to the safety take a look at suite, we’re enhancing the ecosystem for Android customers. The Android Crimson Crew appears to be like ahead to replicating this working relationship with different ecosystem companions to make gadgets safer.
