Loading vulnerability…
CVE-2022-20186 is a vulnerability in the Mali GPU kernel driver for Android, specifically in the kbase_mem_alias function within mali_kbase_mem_linux.c. The vulnerability arises from improper input validation, which allows a local attacker to execute arbitrary code in the kernel context. This can be exploited for local privilege escalation without requiring user interaction or additional execution privileges.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a local proof-of-concept and lab environment for reproducing CVE-2022-20186 / Arm CVE-2022-28348, an integer overflow in Arm Mali GPU Kernel Driver alias handling that leads to a use-after-free. It is not a remote exploit or framework module; it is a reproducible research setup that builds a vulnerable Linux kernel environment, compiles the Mali driver as a module, packages a PoC into an initramfs, and launches a QEMU VM for testing. Repository structure is centered around build-env/. The local/ scripts automate dependency checks, kernel download (Linux 5.10.30), kernel compilation, rootfs creation, PoC compilation, and out-of-tree Mali module compilation. The arm/ directory provides a Dockerized ARM64 build path for Apple Silicon and includes scripts to build the kernel/rootfs and run QEMU. The dist/ directory contains launchers for x86_64 and ARM64 QEMU guests. The mali-driver/ tree is a large vendor driver source snapshot containing the vulnerable driver and supporting modules. Documentation files (README.md, QUICKSTART.md, INSTALL_GUIDE.md) explain how to build, boot, insmod the module, and run /poc/poc. Exploit capability is limited to vulnerability triggering/reproduction. The docs explicitly describe loading mali_kbase.ko and running /poc/poc, with expected output indicating /dev/mali0 access, region allocation, alias creation, and a resulting UAF condition. No post-exploitation payload, persistence, credential theft, reverse shell, or automated privilege-escalation chain is present in the provided content. Accordingly, this is best classified as a POC exploit rather than an operational or weaponized exploit. Notable observables include kernel and driver download URLs, guest file paths such as /poc/poc and /poc/mali_kbase.ko, the Mali device node /dev/mali0, multiple sysfs Mali interfaces documented under /sys/class/misc/mali%u/device/, and QEMU launchers exposing the default GDB stub via -s (TCP 1234).
This repository contains a working exploit for CVE-2022-20186, a vulnerability in the Arm Mali GPU kernel driver affecting Android devices such as the Google Pixel 6 (patch levels Nov 2021 - Feb 2022). The main exploit logic is implemented in 'mali_alias.c', which interacts directly with the vulnerable '/dev/mali0' device node. The exploit leverages a memory corruption bug to gain arbitrary kernel code execution from an unprivileged app context. It then disables SELinux enforcement and escalates privileges to root by overwriting kernel memory structures and invoking commit_creds/init_cred. The exploit is operational and includes custom ARM64 shellcode for privilege escalation. The repository also includes several large header files ('mali.h', 'mali_base_jm_kernel.h', 'midgard.h') that provide necessary structures and constants for interacting with the Mali driver. The build process is automated via a GitHub Actions workflow and instructions are provided for compiling the exploit using the Android NDK. No network endpoints are present; all exploitation is performed locally on the device. The exploit is reliable and can be retried without crashing the device.
This repository contains a fully operational local privilege escalation exploit for CVE-2022-20186, a vulnerability in the Arm Mali GPU kernel driver. The exploit is implemented in C (main file: mali_alias.c) and is designed to run on Android devices, specifically tested on the Google Pixel 6 with patch levels from November 2021 to February 2022. The exploit works by interacting with the /dev/mali0 device node, manipulating GPU memory allocations and page tables to overwrite critical kernel structures, and injecting custom ARM64 shellcode. This shellcode disables SELinux enforcement and escalates the attacker's privileges to root by invoking kernel functions (commit_creds/init_cred). The repository includes several large header files (mali.h, mali_base_jm_kernel.h, midgard.h, offsets.h) that provide necessary constants, structures, and offsets for various supported device builds. The exploit is robust, can be retried without crashing the device, and can be adapted to other firmware versions by updating offsets. No network endpoints are present; the attack vector is purely local, requiring code execution on the target device.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.