Rule Category

OS-MOBILE -- Snort has detected traffic targeting vulnerabilities in a mobile-based operating system. This does not include browser traffic or other software on the OS, but attacks against the OS itself. (such as?)

Alert Message

OS-MOBILE Mali GPU memory alias privilege escalation attempt

Rule Explanation

This rule is looking for operating system profiling that is consistent with exploitation to gain root on Linux based systems that contain a Mali GPU.

What To Look For

This rule is triggered by a malicious file attempting to use a known exploit against the Mali GPU.

Known Usage

Public information/Proof of Concept available

False Positives

No known false positives

Contributors

Cisco Talos Intelligence Group

MITRE ATT&CK Framework

Tactic: Privilege Escalation

Technique: Exploitation for Privilege Escalation

For reference, see the MITRE ATT&CK vulnerability types here: https://attack.mitre.org

CVE

Additional Links

Rule Vulnerability

Escalation of Privilege

An Escalation of Privilege (EOP) attack is any attack method that results in a user or application gaining permissions to access resources they normally would not have access to.

CVE Additional Information

CVE-2022-20186
In kbase_mem_alias of mali_kbase_mem_linux.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-215001024References: N/A
Details
Severity Base Score7.8
Impact Score5.9 Exploit Score1.8
Confidentiality ImpactHIGH Integrity ImpactHIGH
Availability ImpactHIGH Attack VectorLOCAL
ScopeUNCHANGED User InteractionNONE
Authentication Ease of AccessLOW
Privileges RequiredLOW