Qualcomm Patches Actively Exploited Adreno GPU Zero-Day Vulnerabilities

Qualcomm has addressed three critical zero-day vulnerabilities in its Adreno Graphics Processing Unit (GPU) driver that were being actively exploited in targeted attacks. These flaws affect dozens of Qualcomm chipsets used in mobile devices across the Android ecosystem, requiring immediate attention from device manufacturers and security teams.

Executive Summary for Security Leadership

The vulnerabilities (CVE-2023-33106, CVE-2023-33107, and CVE-2022-22071) allow local privilege escalation through memory corruption flaws in the GPU driver. Google’s Threat Analysis Group (TAG) and Project Zero researchers discovered these flaws being used in commercial spyware campaigns targeting both Android and iOS devices. The most severe vulnerability (CVE-2023-33106) received a CVSS score of 8.4 and involves an out-of-bounds write in the GPU driver’s IOCTL interface.

Affected Components: Adreno GPU driver, Compute DSP driver
Attack Vector: Local privilege escalation leading to full device compromise
Exploitation Status: Actively used in targeted attacks by spyware vendors
Patch Status: Fixed in Qualcomm’s October 2023 security bulletin
Mitigation: Requires OEM firmware updates; no effective workarounds

Technical Analysis of the Vulnerabilities

The most critical vulnerability, CVE-2023-33106, stems from insufficient input validation in the IOCTL_KGSL_GPU_AUX_COMMAND handler within the Adreno GPU driver. According to Perdition Security’s analysis, the flaw occurs when processing synchronization objects without proper bounds checking on the param->numsyncs parameter. This allows attackers to write beyond allocated memory boundaries when the value exceeds KGSL_MAX_SYNCPOINTS.

Qualcomm’s patch implements proper bounds checking to prevent memory corruption. The vulnerability was particularly dangerous because the Adreno GPU driver runs with kernel privileges, meaning successful exploitation grants attackers full control over the affected device. Researchers noted that this flaw was often chained with other vulnerabilities (CVE-2023-28540 and CVE-2023-33028) to bypass Android’s security sandbox and install persistent malware.

Exploitation Context and Attack Patterns

Google TAG observed these vulnerabilities being used in watering hole attacks and via malicious applications disguised as legitimate software. The exploit chains typically began with a browser-based attack or malicious app installation, followed by privilege escalation using the GPU driver flaws. Once kernel access was achieved, attackers deployed sophisticated spyware capable of intercepting communications, tracking locations, and exfiltrating sensitive data.

Security researchers have linked these exploits to commercial surveillance vendors, with evidence suggesting their use against journalists, political dissidents, and human rights activists. The attacks were highly targeted, with infection vectors tailored to specific victims rather than broad campaigns.

Affected Devices and Patch Availability

The vulnerabilities impact Qualcomm chipsets across multiple generations, including:

Chipset Series	Example Devices
Snapdragon 8 series	Flagship smartphones (2020-2023)
Snapdragon 7 series	Mid-range devices
Snapdragon 6/4 series	Budget smartphones and tablets

While Qualcomm released patches in October 2023, the actual security update availability depends on device manufacturers and carriers. Many older devices may never receive updates, leaving them permanently vulnerable. Security teams should prioritize updating enterprise-managed devices and consider additional protective measures for unpatched systems.

Detection and Mitigation Strategies

For organizations managing Android devices, the following steps are recommended:

Verify patch levels against Qualcomm’s October 2023 security bulletin
Monitor for suspicious GPU driver activity using EDR solutions
Restrict installation of applications from unknown sources
Implement kernel memory protection mechanisms where available
Consider network-level blocking of known spyware C2 servers

Google has updated Play Protect to detect and block known exploit attempts, but determined attackers may use novel obfuscation techniques to bypass these protections. Network traffic analysis can help identify compromised devices communicating with known malicious infrastructure.

Long-Term Security Implications

These vulnerabilities highlight systemic challenges in mobile device security, particularly the dependency on chipset vendors for critical security updates and the lengthy patch deployment process through OEMs. The active exploitation of GPU driver flaws also demonstrates attackers’ increasing focus on hardware-level vulnerabilities that often receive less scrutiny than application-layer security.

Security teams should advocate for faster patch adoption by device manufacturers and consider additional defense-in-depth measures for high-risk users. The emergence of commercial spyware exploiting these flaws underscores the need for robust mobile threat detection capabilities in enterprise environments.