Fall of the machines: Exploiting the Qualcomm NPU kernel driver

An article about exploiting a use-after-free and two info-leaks in the Qualcomm Neural Processing Unit driver. By Man Yue Mo.

The exploit leaks pointers via info-leaks, overwrites and triggers a function pointer via a racy CPU/NPU use-after-free, runs arbitrary eBPF code via __bpf_prog_run32, disables SELinux by overwriting unprotected selinux_enforcing, and launches a shell via call_usermodehelper.

The article mentions that while Samsung's NPU driver is now restricted by SELinux, the Qualcomm's one is not. This makes the latter a target for untrusted_app->root exploits on devices with Qualcomm chipsets.