CVE-2023-33106

What it actually does

CVE-2023-33106 is a local memory-corruption vulnerability in Qualcomm's KGSL GPU driver path when handling a large list of sync points submitted through the IOCTL_KGSL_GPU_AUX_COMMAND interface. A local attacker with the ability to execute code on an affected device can trigger out-of-bounds or invalid pointer behavior in privileged kernel/driver context, potentially gaining elevated privileges, corrupting kernel memory, disabling security controls, or crashing the device. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, and high confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can turn a limited local foothold on an affected Android, embedded, automotive, IoT, or Qualcomm-based platform into full device compromise. This may allow theft of sensitive data, persistence, tampering with device behavior, disruption of operations, or use of the device as a launch point for further attacks. Because this vulnerability is listed in CISA KEV, has been observed exploited in the wild, and the remediation due date was 2023-12-26, unpatched devices should be treated as high-priority exposure even though the EPSS score is relatively low.

How an attack unfolds

An attacker first obtains local code execution on an affected Qualcomm-based device, commonly through a malicious app, chained browser/app exploit, physical access, or another vulnerability. The attacker then opens the KGSL GPU device interface and submits a crafted AUX command containing an oversized or malformed sync-point list to IOCTL_KGSL_GPU_AUX_COMMAND. The vulnerable driver mishandles the submitted data, causing memory corruption in a privileged execution context. With a reliable exploit, the attacker can manipulate kernel memory to escalate privileges, bypass sandboxing, access protected data, install persistence, or disable security tooling. In observed real-world exploitation, this type of kernel/GPU flaw is often used as a post-compromise privilege-escalation stage rather than as the initial entry point.

How to fix it

Apply the relevant Qualcomm, device OEM, Android security bulletin, firmware, BSP, or carrier update that contains the fix for CVE-2023-33106. No exact fixed package versions were provided in the input, so remediation should be validated against the vendor advisory for each affected chipset, device model, firmware branch, and downstream OEM build. Prioritize devices using affected Qualcomm components including FastConnect 6200/6700/6800/6900/7800, AR8035, CSRA6620/CSRA6640, Flight RB5 5G Platform, and QAM8255P/QAM8295P/QAM8650P/QAM8775P firmware families. Where patching is delayed, reduce risk by restricting installation of untrusted applications, enforcing mobile/endpoint management controls, disabling developer/debug access where possible, limiting local shell access, using application allowlisting, monitoring for rooting/jailbreak indicators, and isolating high-risk or unmanaged devices from sensitive services.

How to confirm the fix worked

Confirm that each affected device or firmware image has received the OEM or Qualcomm security update that explicitly includes the fix for CVE-2023-33106 or the corresponding Qualcomm security bulletin item. For Android-derived systems, verify the security patch level, kernel build, vendor image, and device-specific firmware release against the OEM advisory, not only the base Android OS version. For embedded or automotive platforms, validate the BSP/firmware release notes and confirm the updated KGSL/Adreno driver components are present in the deployed image. Attempting to reproduce the vulnerability in production is not recommended because exploitation may crash or corrupt the device. Instead, use authenticated asset inventory, firmware attestation, MDM/EMM compliance state, vendor patch metadata, and controlled lab validation on representative hardware.

Typical attack path

1. Gain local code execution on an affected Qualcomm-based device through a malicious application, exploit chain, or physical/local access.
2. Identify that the KGSL GPU device interface is present and accessible.
3. Open the KGSL device node, commonly associated with Qualcomm Adreno GPU/KGSL drivers.
4. Submit a crafted AUX command using IOCTL_KGSL_GPU_AUX_COMMAND with an abnormally large or malformed sync-point list.
5. Trigger memory corruption in the Qualcomm KGSL driver.
6. Use the corrupted kernel/driver memory state to escalate privileges or disable security boundaries.
7. Perform follow-on actions such as data theft, persistence, surveillance, tampering, or device disruption.

How to detect it

There are no universally reliable public compromise indicators for this vulnerability because exploitation occurs locally through a kernel/GPU driver interface and may leave minimal forensic evidence. Detection should focus on endpoint/mobile telemetry, kernel logs, crash reports, EDR/MDM alerts, application inventory, and forensic artifacts around the time of suspected compromise. Review logs for abnormal KGSL, Adreno, GPU, or kernel memory-corruption messages; repeated device reboots; kernel panics; SELinux denials involving GPU device nodes; suspicious processes opening /dev/kgsl-*; unexpected root access; bootloader or verified-boot state changes; unauthorized persistence; and newly installed or sideloaded applications preceding privilege escalation. Where telemetry supports syscall or device access auditing, look for untrusted apps or shell processes issuing ioctl activity against Qualcomm KGSL device nodes. Because this CVE is known exploited in the wild, absence of a crash does not rule out compromise; pair log review with device integrity checks and malware triage.

• IOCTL_KGSL_GPU_AUX_COMMAND
• KGSL_GPU_AUX_COMMAND
• kgsl_gpu_aux_command
• /dev/kgsl-3d0
• /dev/kgsl
• /sys/class/kgsl
• kgsl
• adreno
• AUX command
• sync points
• kernel panic
• BUG:
• Unable to handle kernel paging request
• slab-out-of-bounds
• use-after-free
• general protection fault

What your security team should do

• Treat this as an urgent patching item because it is in CISA KEV and has documented in-the-wild exploitation; the KEV remediation deadline of 2023-12-26 has already passed.
• Inventory Qualcomm-based Android, embedded, IoT, automotive, and specialized devices that may include affected chipsets or firmware families.
• Map each device model and firmware branch to the OEM or Qualcomm advisory and identify whether the fix has been delivered and installed.
• Prioritize remediation for internet-adjacent, unmanaged, high-privilege, executive, operational technology, field, and sensitive-data devices.
• Hunt for signs of local privilege escalation, rooting, unexpected kernel crashes, suspicious access to KGSL device nodes, and unknown applications invoking GPU driver IOCTL paths.
• Restrict untrusted application installation and local shell/debug interfaces until patching is complete.
• For devices that cannot be patched, apply compensating controls such as network isolation, app allowlisting, increased telemetry, and replacement planning.
• Coordinate with device OEMs and carriers where updates are not directly controlled by the organization.