Rooting is a method used by users—or potential attackers—to gain elevated control over an operating system, bypassing restrictions imposed by device manufacturers and carriers.
Senior mobile security researchers Pan Zhenpeng and Jheng Bing Jhong from STAR Labs have unveiled groundbreaking research that reveals two unique methods for rooting nearly all Android devices powered by Qualcomm chipsets.
Their technique, named “GPUAF” (GPU Use-After-Free), combines multiple vulnerabilities found in Qualcomm’s GPU drivers to gain full system control. The exploit affects devices from major manufacturers such as Samsung, Xiaomi, Honor, and Vivo.
Critical Vulnerabilities in Qualcomm GPU Drivers
The team identified three major vulnerabilities:
- CVE-2024-23380: A race condition in the Kgsl VBO map buffer.
- CVE-2024-23373: A Use-After-Free flaw triggered by failed unmap operations.
- An unnamed third vulnerability: Related to premature destruction of page table entries.
According to the researchers, chaining these vulnerabilities causes discrepancies between the GPU driver’s internal data structures and the IOMMU (Input-Output Memory Management Unit) mappings.
“By chaining these vulnerabilities, we create inconsistencies between the GPU driver’s internal structures and the IOMMU mappings,” the researchers noted in their technical analysis.
The exploit initiates a race between two bind operations, causing the GPU driver to mishandle memory mappings. As a result, memory pages that should have been freed remain accessible via the GPU.
Two Exploitation Techniques for Root Access
The researchers presented two different approaches to achieve root access:
1. Page Table Manipulation
This method involves reclaiming freed memory pages as ARM64 page tables. Attackers can then alter the AP[2:1] protection bits, converting read-only memory into writable memory, thereby escalating privileges and enabling full system control.
Once attackers gain control over the page tables, they can escalate their privileges by disabling SELinux. This is done by overwriting the selinux_state structure, effectively granting themselves root access.
Pipe Buffer Exploitation
The second method involves reclaiming freed memory pages and repurposing them as pipe_buffer structures:
By manipulating the pipe_buffer structure, attackers gain arbitrary read and write access to system memory. This is achieved using the copy_page_to_iter and copy_page_from_iter functions when the PIPE_BUF_FLAG_CAN_MERGE flag is enabled.
Wide-Ranging Impact
This exploit affects a wide array of devices, including:
- Samsung Galaxy S series (non-Exynos variants)
- Honor phones (e.g., X9b, 90)
- Xiaomi models (e.g., 14, 14 Pro, Redmi Note 13 Pro)
- Vivo devices (e.g., iQOO Z9s Pro, T3 Pro)
The researchers also demonstrated that their method can bypass advanced security mechanisms such as Samsung’s Enhanced SELinux and the KNOX hypervisor, both of which operate at EL2 (Exception Level 2).
“What makes this attack particularly concerning is its broad applicability across vendors and its ability to bypass hardware-backed security measures,” the researchers emphasized.
Although Qualcomm has released patches addressing these vulnerabilities, security experts urge users to apply updates promptly. Left unpatched, these flaws could allow attackers to gain full control over devices, extract sensitive data, and install persistent malware.
GPUAF marks a significant leap in Android exploitation, revealing how GPU driver vulnerabilities can be chained for total device compromise—and highlighting the urgent need for layered, hardware-enforced mobile security protections.
