How GPU DMA Bypasses Four Samsung Galaxy Kernel Protections
Summary
The article explains how a Qualcomm KGSL vulnerability, CVE-2025-21479, can let GPU DMA bypass Samsung kernel protections, corrupt a process page table, disable SELinux and inject code into Android's init process.
Key points
- The research uses a KGSL command-submission vulnerability, CVE-2025-21479, to make the GPU reload attacker-controlled page tables and access arbitrary physical memory through DMA.
- Samsung's RKP and KDP protections rely on CPU Stage 2 translation checks; DEFEX uses kernel policy checks, while JOPP/ROPP protect control-flow pointers and return addresses.
- The article says GPU DMA writes bypass CPU translation and Stage 2 checks, allowing the attacker to modify a process page-table entry despite those protections.
- A self-referencing page-table technique turns the initial slow GPU read/write capability into fast CPU access to the process's page-table entries.
- The described chain uses that access to make SELinux permissive, then writes shellcode into an executable page belonging to Android's init process and redirects a PLT entry to it.
- The article argues that GPU command validation or hypervisor visibility into peripheral DMA would be needed to address the architectural gap.
Article Details
- Attack Vectors
- The article describes exploiting the KGSL command-submission vulnerability CVE-2025-21479 to issue GPU DMA reads and writes to arbitrary physical memory.
- GPU DMA is used to corrupt a process page-table entry, creating a self-referencing page-table mapping and enabling fast physical-memory access.
- The described chain uses that access to disable SELinux and write shellcode into executable pages of Android's init process, then redirects a PLT entry to the shellcode.
- Defensive Notes
- Validate GPU command streams so page-table-reload commands cannot target arbitrary physical addresses.
- Consider hypervisor visibility into peripheral DMA; the article identifies CPU-only monitoring as the architectural gap that lets GPU writes bypass the protections.
- The article says independent protection solutions may be needed in addition to built-in device kernel defenses.
MITRE ATT&CK
T1055 · Process InjectionThe described exploit writes ARM64 shellcode into init's executable pages and redirects a PLT entry to execute it.T1068 · Exploitation for Privilege EscalationThe article describes exploiting CVE-2025-21479 in KGSL to obtain arbitrary physical-memory access and bypass kernel protections for privilege escalation.T1562.001 · Disable or Modify ToolsThe exploit writes zero to the enforcing byte in selinux_state, leaving SELinux permissive.
CVE
People
Vendors
QualcommQualcomm's KGSL (Kernel Graphics Support Layer) driver exposes /dev/kgsl-3d0 to applications. This is how apps submit rendering work to the Adreno GPU. In this research we use a vulnerability in KGSL command submissionSamsungwrite. On a stock Linux kernel, you would overwrite your process UID to zero and call it a day. But on Samsung Galaxy phone, you quickly discover that physical memory access is far from the end of the problem — all
Products
AndroidInstead, we write code directly into a running process's executable pages. The target is init (PID 1), the most privileged process on Android, running as root with full capabilities and on every DEFEX allowlist.KGSLQualcomm's KGSL (Kernel Graphics Support Layer) driver exposes /dev/kgsl-3d0 to applications. This is how apps submit rendering work to the Adreno GPU. In this research we use a vulnerability in KGSL command submissionSamsung KnoxIntroduction to Samsung Knox mobile securitySELinuxExploitation Step 2 — disabling SELinux