# CVE-2024-44068: Samsung m2m1shot_scaler0 device driver page use-after-free in Android

Samsung m2m1shot_scaler0 driver fails to refcount PFNMAP pages, enabling page UAF and KSMA to overwrite page tables for kernel EoP.

- Payout: Real-world hack
- Severity: high
- Program: Samsung Android
- Credited: Xingyu Jin and Clement Lecigne
- Disclosed: 2024-10-07
- CVE: CVE-2024-44068
- Write-up quality: 9/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2024/CVE-2024-44068.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2024-44068
- Tags: domain:mobile impact:privesc impact:rce kind:incident platform:project-zero sev:high tech:linux technique:race-window technique:source-review vuln:memory-corruption vuln:race-condition

**Target:** Samsung Exynos m2m1shot_scaler0 media IOCTL driver
**Root cause:** sysmmu_map_pte skips get_page() for PFNMAP pages but exynos_iommu_unmap_userptr still put_page()s them, so munmap during IOCTL frees pages still mapped in IOVA.
**Steps:**
1. Open m2m1shot_scaler0 and prepare m2m1shot_task with V4L2_PIX_FMT_YUV420M, M2M1SHOT_BUFFER_USERPTR, 3 planes each 0x8000.
2. Set buf_cap.plane[0].userptr to a PFNMAP (ION) mapping; set buf_cap.plane[1].userptr to an anonymous MAP_SHARED mapping.
3. Fill buf_out.plane[0].userptr with a crafted PMD entry; set op=M2M1SHOT_OP_CSC_NARROW.
4. Issue `ioctl(fd, 0xC0C04D00, &m2m1shot_task)`; concurrently poll `mincore(buf_cap.plane[1].userptr,0x1000,vec)` until vec[0] set, then `munmap(buf_cap.plane[0].userptr,0x8000)`.
5. Firmware CSC copies buf_out data into the freed IOVA pages, overwriting a live PMD entry (KSMA).
**How found:** Code audit of driver memory management: noticed get_page() skipped for PFNMAP pages while teardown still put_page()s them, implying a refcount imbalance exploitable via munmap race.
**Exploitation:** Zero-day in an EoP chain: attacker already runs code in privileged cameraserver, uses the UAF to mirror kernel memory via KSMA and escalate to kernel; exploit renamed its process to vendor.samsung.hardware.camera.provider@3.0-service for anti-forensics. Works on S10 (G973FXXSGHWC2).
**Escalation:** Page UAF converted to KSMA by spamming page tables so the firmware copy overwrites an in-use PMD entry, giving kernel memory read/write.
**Insight:** When auditing IOMMU/userptr mapping code, compare get_page/put_page symmetry across PFNMAP vs normal pages; a skipped refcount on PFNMAP plus teardown put_page yields a freeable page still mapped in IOVA. Use mincore on a second lazy-mapped plane to time munmap inside the IOCTL window.