maliGPU

Mali GPU CVE reproduction lab. The repository keeps the reproducible parts of the environment: scripts, configs, patches, PoCs, and rootfs overlays. Third-party source trees and generated build artifacts stay local.

Current lab layout:

QEMU aarch64 guest + loadable Mali kbase/no-Mali experiment drivers

Requirements

Ubuntu 22.04 is the recommended host environment. The guest target is aarch64.

On an x86_64 host, install the cross toolchain and build dependencies:

sudo apt update
sudo apt install -y \
  build-essential bc bison flex libssl-dev libelf-dev \
  gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libc6-dev-arm64-cross \
  qemu-system-aarch64 cpio gzip patch file git

On an aarch64 host, the scripts use the native compiler by default.

The toolchain can be overridden when needed:

CROSS_COMPILE=aarch64-linux-gnu- ./scripts/setup/build_kernel.sh
CC=aarch64-linux-gnu-gcc ./scripts/CVE-2022-36449-issue2327/prepare.sh

Third-party Sources

Prepare local source trees under third_party/:

third_party/
  linux/linux-5.4.302/
  busybox/busybox-1.36.1/
  mali/r28p0-bifrost/
  mali/r38p0-bifrost/
  mali/r47p0-bifrost/

See third_party/README.md for details. These sources are intentionally ignored by Git.

Check the local setup for all labs or for one lab:

./scripts/setup/check_deps.sh
./scripts/setup/check_deps.sh CVE-2022-36449-issue2327

Build from Scratch

Build BusyBox and the kernel once:

./scripts/setup/build_busybox.sh
./scripts/setup/build_kernel.sh

Prepare the CVE-2021-28663 r28p0/r47 no-Mali experiment:

./scripts/setup/prepare_mali_experiment.sh
AUTO_RUN=0 ./scripts/CVE-2021-28663/prepare.sh

Prepare the CVE-2022-36449 / Project Zero issue 2327 r38p0 no-Mali experiment:

AUTO_RUN=0 ./scripts/CVE-2022-36449-issue2327/prepare.sh

Successful builds generate local artifacts such as:

out/Image
out/rootfs.cpio.gz
build/experiments/r28p0-nomali-r47-model/
build/experiments/r38p0-nomali/

Run Labs

CVE-2021-28663:

./scripts/CVE-2021-28663/start.sh

CVE-2022-36449 / Project Zero issue 2327:

./scripts/CVE-2022-36449-issue2327/start.sh

Inside the guest, run:

/run_lab.sh

For CVE-2021-28663, these messages indicate the no-Mali LKM path is working:

mali mali.0: Kernel DDK version r28p0-01eac0
mali mali.0: Using Dummy Model
mali mali.0: Probed as mali0
/dev/mali0
Version major,minor = 11,29

Common Variables

AUTO_RUN=1          # Build rootfs with /run_lab.sh autorun enabled.
QEMU_MEM=4096      # QEMU memory in MiB.
GDB=1              # Start QEMU paused with gdb stub on :1234.
CROSS_COMPILE=...  # Override cross compiler prefix.
CC=...             # Override PoC compiler.
JOBS=8             # Override make parallelism.

Repository Layout

configs/       Versioned kernel and BusyBox configs.
patches/       Compatibility patches for third-party source trees.
platforms/     QEMU fake Mali platform-device module.
pocs/          Per-CVE PoC source and notes.
rootfs/        Rootfs base files and overlays.
scripts/setup/ Reusable setup/build helpers.
scripts/CVE-*/ Per-CVE prepare/start entry points.
third_party/   Local third-party source trees; only README is tracked.
build/         Generated experiment/rootfs output; ignored.
out/           Generated kernel/rootfs/dump output; ignored.