Memory Corruption in Qualcomm Page-Fault Packet Processing

This repository contains a proof-of-concept (PoC) local exploit targeting a use-after-free (UaF) vulnerability in the Qualcomm KGSL GPU driver, as used in Samsung Snapdragon Gen 1 Android devices. The main exploit logic is implemented in C across several files: - `trigger.c` is the main entry point, orchestrating the exploit by allocating GPU memory, freeing it, and submitting commands to the GPU driver to trigger the UaF condition. It supports multiple approaches and threading to increase the likelihood of triggering the bug. - `kgsl.c`, `kgsl.h`, and `kgsl_struct.h` provide the low-level interface to the KGSL driver, including IOCTL definitions, memory allocation, command submission, and fault reporting. - `cpu_utils.c` and `cpu_utils.h` provide CPU affinity utilities to pin threads to specific CPUs, which can help with exploit timing. - `kgsl_tracer.sh` is a Bash script to assist with kernel tracing of KGSL events, useful for debugging and observing the effects of the exploit. - The `Makefile` builds the exploit binary and provides an install target to push it to an Android device. The exploit requires local access to a vulnerable device, with the ability to execute binaries and access the /dev/kgsl-3d0 device node. The code does not include a weaponized payload (e.g., privilege escalation or shell), but demonstrates the ability to trigger and observe the UaF condition. The repository is structured for research and educational purposes, as stated in the README, and references a detailed blog post for further context. No network endpoints are involved; all actions are performed locally on the device.