# CVE-2023-33106: Qualcomm Adreno GPU KGSL_GPU_AUX_COMMAND_SYNC OOB

Qualcomm Adreno GPU KGSL driver lacks bounds check on numsyncs, leading to out-of-bounds write via set_bit, exploited in the wild.

- Payout: Real-world hack
- Severity: high
- Program: Qualcomm Adreno GPU
- Credited: Clement Lecigne of Google's Threat Analysis Group
- Disclosed: 2023-10-02
- CVE: CVE-2023-33106
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2023/CVE-2023-33106.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2023-33106
- Tags: domain:mobile impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:android technique:source-review vuln:memory-corruption

**Target:** KGSL GPU driver ioctl
**Root cause:** Missing validation of param->numsyncs in kgsl_ioctl_gpu_aux_command allows user-controlled bit index in set_bit, causing OOB write.
**Steps:**
1. Open /dev/kgsl-3d0
2. Create draw context via IOCTL_KGSL_DRAWCTXT_CREATE
3. Create timeline via IOCTL_KGSL_TIMELINE_CREATE
4. Prepare kgsl_gpu_aux_command with flags KGSL_CONTEXT_SYNC|KGSL_GPU_AUX_COMMAND_TIMELINE and numsyncs > 32
5. Invoke IOCTL_KGSL_GPU_AUX_COMMAND with the command
**How found:** Could have been found via manual code review or fuzzing; reporter had access to exploit sample.
**Exploitation:** Exploited in the wild as a zero-day; exploit sample not public. Likely used to achieve kernel memory corruption and privilege escalation.
**Insight:** Audit set_bit/clear_bit calls where the bit index is user-controlled; ensure bounds checks against bitmap size.