Mali GPU Driver Flaws Enabled Root on Google Pixel Devices

STAR Labs detailed two exploit chains showing how vulnerabilities in the Arm Mali GPU driver could be turned into full kernel compromise on Google Pixel phones. One write-up analyzed CVE-2023-6241, a race condition in kbase_jit_grow on a Pixel 8 running Android 14, where stale allocation state after a lock drop left some physical pages backed but unmapped. That inconsistency was used to trigger a page use-after-free, reclaim the freed page, and build arbitrary kernel read/write primitives. The exploit then overwrote kernel code to disable SELinux enforcement and invoked commit_creds(&init_cred) to gain root from the unprivileged untrusted_app_27 context; STAR Labs said excessive WARN_ON logging initially stretched exploitation to about 10 minutes before testing reduced runtime to under five seconds.

A second write-up showed that CVE-2023-48409 alone was sufficient to compromise a Pixel 6 Pro, contradicting earlier assumptions that exploitation also required CVE-2023-26083. STAR Labs described the bug as an integer-overflow-driven out-of-bounds write in the Pixel Mali driver and said exploitation bypassed CONFIG_HARDENED_USERCOPY by targeting page-allocator-backed objects and using pagetable spraying techniques inspired by Dirty Pagetable. The researchers also mapped Android-specific constraints including seccomp, SELinux, and privilege-escalation mechanics, and found that while the earlier pointer-leak bug still existed on affected devices, the practical path relied on leaking a kbase_context object exposing a task_struct pointer for direct credential manipulation. Both reports said the affected issues were patched in later Android security updates.