CVE-2023-21106

What it actually does

Double free in adreno_set_param of adreno_gpu.c leads to memory corruption and local privilege escalation on Android kernels.

Why it matters to the business

Attackers with local access can gain elevated privileges on affected Android devices without user interaction, increasing risk of full device compromise; the issue appears in widely used kernel code with downstream dependents.

How an attack unfolds

An attacker with local access triggers the double-free condition in the Adreno GPU driver parameter handling path, corrupting kernel memory structures to execute arbitrary code and escalate privileges; listed threat actor context involves Linux kernel ownership management flaws.

How to fix it

Upgrade cloudflare/workers-sdk (GIT) to commit 881ea7be43bcd5a3b7ea1d708c04408c9c27d50d or later; apply the corresponding upstream kernel patch that corrects the double-free condition in adreno_gpu.c.

How to confirm the fix worked

Confirm the fixed commit is present in the kernel source; verify absence of the vulnerable adreno_set_param double-free pattern via code review or kernel build checks.

Typical attack path

1. Obtain local access to a vulnerable Android device
2. Invoke adreno_set_param with crafted parameters to trigger double free
3. Exploit resulting memory corruption for kernel code execution
4. Escalate to root privileges

How to detect it

Review kernel logs and crash dumps for double-free signatures in adreno_gpu.c paths; correlate with process execution attempting GPU parameter manipulation under the listed threat actor patterns.

What your security team should do

• Prioritize patching Android kernels containing the Adreno driver within the next 30 days given the 1250 days since publication
• Monitor EPSS trend stability and re-evaluate if exploit maturity changes
• Apply the exact fixed commit 881ea7be43bcd5a3b7ea1d708c04408c9c27d50d across all affected builds