Who cares about GPUs?
You, me, and the whole ecosystem! GPUs (graphics processing models) are vital in delivering wealthy visible experiences on cellular units. Nonetheless, the GPU software program and firmware stack has grow to be a approach for attackers to achieve permissions and entitlements (privilege escalation) to Android-based units. There are many points on this class that may have an effect on all main GPU manufacturers, for instance, CVE-2023-4295, CVE-2023-21106, CVE-2021-0884, and extra. Most exploitable GPU vulnerabilities are within the implementation of the GPU kernel mode modules. These modules are items of code that load/unload throughout runtime, extending performance with out the necessity to reboot the machine.
Proactive testing is nice hygiene as it could result in the detection and backbone of recent vulnerabilities earlier than they’re exploited. It’s additionally probably the most complicated investigations to do as you don’t essentially know the place the vulnerability will seem (that’s the purpose!). By combining the experience of Google’s engineers with IP house owners and OEMs, we are able to make sure the Android ecosystem retains a powerful measure of integrity.
Why examine GPUs?
When researching vulnerabilities, GPUs are a well-liked goal as a result of:
- Performance vs. Safety Tradeoffs
No person desires a gradual, unresponsive machine; any hits to GPU efficiency may lead to a noticeably degraded consumer expertise. As such, the GPU software program stack in Android depends on an in-process HAL mannequin the place the API & consumer house drivers speaking with the GPU kernel mode module are operating immediately throughout the context of apps, thus avoiding IPC (interprocess communication). This opens the door for doubtlessly untrusted code from a 3rd social gathering app with the ability to immediately entry the interface uncovered by the GPU kernel module. If there are any vulnerabilities within the module, the third social gathering app has an avenue to use them. Because of this, a doubtlessly untrusted code operating within the context of the third social gathering software is ready to immediately entry the interface uncovered by the GPU kernel module and exploit potential vulnerabilities within the kernel module.
- Selection & Reminiscence Security
Moreover, the implementation of GPU subsystems (and kernel modules particularly) from main OEMs are more and more complicated. Kernel modules for many GPUs are usually written in reminiscence unsafe languages equivalent to C, that are vulnerable to reminiscence corruption vulnerabilities like buffer overflow.
Can somebody do one thing about this?
Nice information, we have already got! Who’s we? The Android Pink Group and Arm! We’ve labored collectively to run an engagement on the Mali GPU (extra on that under), however first, a short introduction:
Android Pink Group
The Android Pink Group performs time-bound safety evaluation engagements on all facets of the Android open supply codebase and conducts common safety evaluations and assessments of inside Android parts. All through these engagements, the Android Pink Group recurrently collaborates with third social gathering software program and {hardware} suppliers to investigate and perceive proprietary and “closed supply” code repositories and related supply code which are utilized by Android merchandise with the only real goal to determine safety dangers and potential vulnerabilities earlier than they are often exploited by adversaries exterior of Android. This yr, the Android Pink Group collaborated immediately with our business accomplice, Arm, to conduct the Mali GPU engagement and additional safe hundreds of thousands of Android units.
Arm Product Safety and GPU Groups
Arm has a central product safety group that units the coverage and apply throughout the corporate. Additionally they have devoted product safety specialists embedded in engineering groups. Arm operates a scientific method which is designed to forestall, uncover, and get rid of safety vulnerabilities. This features a Safety Improvement Lifecycle (SDL), a Monitoring functionality, and Incident Response. For this collaboration the Android Pink Groups had been supported by the embedded safety specialists based mostly in Arm’s GPU engineering group.
Working collectively to safe Android units
Google’s Android Safety groups and Arm have been working collectively for a very long time. Safety necessities are by no means static, and challenges exist with all GPU distributors. By ceaselessly sharing experience, the Android Pink Group and Arm had been in a position to speed up detection and backbone. Investigations of recognized vulnerabilities, potential remediation methods, and hardening measures drove detailed analyses and the implementation of fixes the place related.
Latest analysis targeted on the Mali GPU as a result of it’s the preferred GPU in right now’s Android units. Collaborating on GPU safety allowed us to:
- Assess the influence on the broadest phase of the Android Ecosystem: The Arm Mali GPU is without doubt one of the most used GPUs by authentic gear producers (OEMs) and is discovered in lots of in style cellular units. By specializing in the Arm Mali GPU, the Android Pink Group may assess the safety of a GPU implementation operating on hundreds of thousands of Android units worldwide.
- Consider the reference implementation and vendor-specific adjustments: Telephone producers usually modify the upstream implementation of GPUs. This tailors the GPU to the producer’s particular machine(s). These modifications and enhancements are all the time difficult to make, and might generally introduce safety vulnerabilities that aren’t current within the authentic model of the GPU upstream. On this particular occasion, the Google Pixel group actively labored with the Android Pink Group to raised perceive and safe the modifications they made for Pixel units.
Enhancements
Investigations have led to vital enhancements, leveling up the safety of the GPU software program/firmware stack throughout a large phase of the Android ecosystem.
Testing the kernel driver
One key part of the GPU subsystem is its kernel mode driver. Throughout this engagement, each the Android Pink Group and Arm invested vital effort wanting on the Mali kbase kernel driver. On account of its complexity, fuzzing was chosen as the first testing method for this space. Fuzzing automates and scales vulnerability discovery in a approach not potential by way of guide strategies. With assist from Arm, the Android Pink Group added extra syzkaller fuzzing descriptions to match the most recent Mali kbase driver implementation.
The group constructed a number of customizations to allow fuzzing the Mali kbase driver within the cloud, with out bodily {hardware}. This offered an enormous enchancment to fuzzing efficiency and scalability. With the Pixel group’s help, we additionally had been in a position to arrange fuzzing on precise Pixel units. Via the mix of cloud-based fuzzing, Pixel-based fuzzing, and guide assessment, we had been in a position to uncover two reminiscence points in Pixel’s customization of driver code (CVE-2023-48409 and CVE-2023-48421).
Each points occurred within the gpu_pixel_handle_buffer_liveness_update_ioctl perform, which is applied by the Pixel group as a part of machine particular customization. These are each reminiscence points brought on by integer overflow issues. If exploited rigorously alongside different vulnerabilities, these points may result in kernel privilege escalation from consumer house. Each points had been fastened and the patch was launched to affected units in Pixel safety bulletin 2023-12-01.
Testing the firmware
Firmware is one other basic constructing block of the GPU subsystem. It’s the middleman working with kernel drivers and GPU {hardware}. In lots of instances, firmware performance is immediately/not directly accessible from the applying. So “software ⇒ kernel ⇒ firmware ⇒ kernel” is a identified assault circulation on this space. Additionally, generally, firmware runs on embedded microcontrollers with restricted sources. Generally used safety kernel mitigations (ASLR, stack safety, heap safety, sure sanitizers, and so forth.) won’t be relevant to firmware as a result of useful resource constraints and efficiency influence. This could make compromising firmware simpler, in some instances, than immediately compromising kernel drivers from consumer house. To check the integrity of current firmware, the Android Pink Group and Arm labored collectively to carry out each fuzzing and formal verification together with guide evaluation. This multi-pronged method led to the invention of CVE-2024-0153, which had a patch launched in the July 2024 Android Safety Bulletin.
CVE-2024-0153 occurs when GPU firmware handles sure directions. When dealing with such directions, the firmware copies register content material right into a buffer. There are dimension checks earlier than the copy operation. Nonetheless, below very particular circumstances, an out-of-bounds write occurs to the vacation spot buffer, resulting in a buffer overflow. When rigorously manipulated, this overflow will overwrite another vital buildings following the buffer, inflicting code execution within the GPU firmware.
The circumstances mandatory to achieve and doubtlessly exploit this subject are very complicated because it requires a deep understanding of how directions are executed. With collective experience, the Android Pink Group and Arm had been in a position to confirm the exploitation path and leverage the problem to achieve restricted management of GPU firmware. This finally circled again to the kernel to acquire privilege escalation. Arm did a wonderful job to reply rapidly and remediate the problem. Altogether, this highlights the energy of collaboration between each groups to dive deeper.
Time to Patch
It’s identified that attackers exploit GPU vulnerabilities within the wild, and time to patch is essential to scale back danger of exploitation and shield customers. Because of this engagement, 9 new Safety Take a look at suite (STS) checks had been constructed to assist companions routinely examine their builds for lacking Mali kbase patches. (Safety Take a look at Suite is software program offered by Google to assist companions automate the method of checking their builds for lacking safety patches.)
What’s Subsequent?
The Arm Product Safety Group is actively concerned in security-focused business communities and collaborates carefully with its ecosystem companions. The engagement with the Android Pink Group, for example, offers beneficial enablement that drives finest practices and product excellence. Constructing on this collaborative method, Arm is complementing its product safety assurance capabilities with a bug bounty program. This funding will increase Arm’s efforts to determine potential vulnerabilities. For extra data on Arm’s product safety initiatives, please go to this product safety web page.
The Android Pink Group and Arm proceed to work collectively to proactively increase the bar on GPU safety. With thorough testing, speedy fixing, and updates to the safety check suite, we’re bettering the ecosystem for Android customers. The Android Pink Group seems ahead to replicating this working relationship with different ecosystem companions to make units safer.
