Racing Against the Lock: Exploiting Spinlock UAF in the Android Kernel

A talk (slides) by Moshe Kol about exploiting a slab use-after-free bug in the Android Binder IPC.

The exploit achieves kernel arbitrary read/write primitives from the unstrusted_app context and obtains root privileges on Pixel 6.

Moshe also published an article about their exploit.