## https://sploitus.com/exploit?id=D9CC7EB9-0057-5D7E-993B-8BA83B86A5B9
# iQOO Neo9 PD2338 KGSL Kernel Vulnerability Research
This repository documents the ongoing investigation of the Qualcomm KGSL GPU driver on the iQOO Neo9 (PD2338) platform. The work focuses on kernel-level vulnerability analysis, ioctl path validation, and the feasibility of a full privilege-escalation chain.
## 1. Target Device Configuration
| Item | Detail |
|------|--------|
| Device | iQOO Neo9 PD2338 |
| SoC | Snapdragon 8 Gen 2 (SM8550 / kalama) |
| GPU | Adreno 740 (Gen7) |
| Kernel | 5.15.178-gaacdc35637c4-dirty |
| Android | 15 (SDK 35) |
| Security patch level | 2025-10-01 |
| SELinux | Enforcing |
| MTE | KASAN_HW_TAGS=y (async mode) |
| kptr_restrict | 2 |
| perf_event_paranoid | -1 |
## 2. Project Directory Structure
```
Molulu/
├── poc/ # Proof-of-concept source code
│ ├── kgsl.h # KGSL ioctl definitions (validated)
│ ├── Makefile # Cross-compilation build script
│ ├── perf_leak.c # KASLR bypass via perf_event_open
│ ├── kgsl_probe2.c # KGSL ioctl probe
│ ├── kgsl_submit.c # SUBMIT_COMMANDS ioctl scanner
│ ├── kgsl_uaf.c # Double-free / bogus-free probe
│ ├── kgsl_uaf2.c # Stale-ID use-after-free probe
│ ├── kgsl_crash.c # _submit_hw_fence overflow crash test
│ └── poc_exploit.c # Full exploit framework
├── docs/
│ └── KGSL-ANALYSIS.md # Detailed driver analysis notes
├── rom/
│ └── rom_sources.txt # ROM file manifest for large artifacts
├── kgsl_text.txt # Disassembly output for kgsl.ko
├── build_neo9.sh # Build helper for the Neo9 target
├── setup_wsl.sh # WSL Ubuntu setup script
├── LICENSE # Apache 2.0
└── README.md # Project summary
```
## 3. Confirmed Results With Hard Evidence
The current evidence supports the following conclusions.
### 3.1 KASLR Bypass via perf_event_open
The perf subsystem is accessible on the target due to `perf_event_paranoid=-1`. A user-space probe using `perf_event_open` can collect kernel instruction-pointer samples and recover KASLR-related address information. This provides a practical path to kernel address leak and is considered a confirmed primitive.
### 3.2 KGSL IOCTL Interface Validation
Runtime probing confirmed that the device accepts KGSL ioctl requests through the expected driver entry points. The following ioctl values were observed in practice:
- nr=0x40: used by SUBMIT_COMMANDS and related memory/context operations
- nr=0x02: used for DEVICE_GETPROPERTY
- Additional values such as 0x38, 0x39, and 0x58 were also observed during runtime scanning
This validates the mapping layer between user-space ioctl requests and the KGSL driver dispatch path.
### 3.3 _submit_hw_fence Overflow Path
The analysis identified a heap-overflow primitive in the KGSL submission path. In the `_submit_hw_fence` flow, timeline syncpoints can be supplied in a way that causes the write count to exceed the intended bounded size. The overflow target is the kmalloc-1024 command buffer associated with the submission path. The behavior is consistent with a genuine out-of-bounds write condition, although a full kernel compromise remains blocked by the missing heap-spray primitive.
## 4. Driver Audit and Path Falsification
The investigation also included a negative-validation pass against several commonly assumed exploitation paths.
### 4.1 Confirmed to be patched or unavailable
- CVE-2025-38236: not viable on this target. The exact trigger returned EAGAIN during testing, indicating the patch is effective on the current firmware.
- SystemV IPC (msg_msg): not usable. The kernel configuration does not expose this primitive on the device, and the attempt returns ENOSYS.
- keyctl / user_key_payload: blocked by SELinux policy. Attempts to add a key are denied with EPERM.
- SCM_RIGHTS fd passing spray: unstable and not reliable enough for exploitation work.
- io_uring: not enabled on the target kernel configuration.
### 4.2 Implication
These paths are no longer considered viable exploitation vectors for the current phase of the project. The investigation should focus on alternative spray and corruption primitives that are compatible with the KGSL allocator and submission path.
## 5. Current Bottleneck and Attack Priorities
The primary blocker is not the overflow itself, but the lack of a reliable heap-spray primitive that can place attacker-controlled memory adjacent to the vulnerable allocation.
### Current bottlenecks
- No stable kernel heap spray primitive is available on the target.
- The overflow is real, but it cannot yet be converted into a reproducible privilege-escalation chain.
- Existing kernel-side primitives such as msg_msg, keyctl, and SCM_RIGHTS do not provide a dependable path under this firmware configuration.
### Immediate priorities
1. Find an alternative allocator spray primitive compatible with the target kernel.
2. Reproduce the overflow under a controlled memory layout that permits deterministic adjacent-object placement.
3. Build a reliable post-overflow primitive to turn the heap corruption into a kernel write or leak primitive.
4. Continue auditing KGSL allocation and submission paths for additional control surfaces.
## 6. Build and Execution Notes
The PoC sources in the `poc/` directory can be built with the provided Makefile and deployed to the device via adb.
```bash
cd poc
make all
make push
```
## License
Apache License 2.0 — see [LICENSE](LICENSE) for details.
---
This project is intended for security research and educational purposes only. Unauthorized access to devices you do not own is illegal.