GAINING KERNEL CODE EXECUTION ON AN MTE-ENABLED PIXEL 8

Summary from the TLDR InfoSec newsletter

This blog post describes a logic bug in the memory management unit of the ARM Mali GPU used in Pixel 8 phones that can be used to bypass Memory Tagging Extension (MTE). This vulnerability, GHSL-2023-005, is related to GPU memory handling, particularly JIT memory, and how it is managed by the kbase_context in the Mali GPU driver. Attackers can cause inconsistencies in GPU memory mapping by exploiting the race window between memory growth triggers.