Arm Mali GPU Kernel Driver read-only page write via incomplete flag check in kbase_jd_user_buf_pin_pages

#!/bin/bash
# check_mali_cve_2022_22706.sh
# Checks whether the Mali GPU kernel driver is vulnerable to CVE-2022-22706
# Run on the target Android/Linux device via: adb shell 'bash -s' < check_mali_cve_2022_22706.sh
# No root required. Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

VULNERABLE=1
PATCHED=0
UNKNOWN=2

# Try multiple known paths for Mali driver version
MALI_VERSION=""
for path in /sys/module/mali_kbase/version \
             /sys/module/mali/version \
             /sys/module/mali_kbase/parameters/mali_debug_level \
             /proc/driver/mali/version; do
    if [ -r "$path" ]; then
        MALI_VERSION=$(cat "$path" 2>/dev/null)
        break
    fi
done

# Fallback: check Android security patch level
SPL=$(getprop ro.build.version.security_patch 2>/dev/null)

if [ -z "$MALI_VERSION" ] && [ -z "$SPL" ]; then
    echo "UNKNOWN - Could not determine Mali driver version or Android patch level."
    echo "Device may not have a Mali GPU or paths are non-standard."
    exit $UNKNOWN
fi

# Check Android security patch level (fix shipped in 2023-06-05)
if [ -n "$SPL" ]; then
    # Compare dates: if SPL >= 2023-06-05, patched at OS level
    SPL_NUM=$(echo "$SPL" | tr -d '-')
    FIXED_NUM="20230605"
    if [ "$SPL_NUM" -ge "$FIXED_NUM" ] 2>/dev/null; then
        echo "PATCHED - Android security patch level $SPL >= 2023-06-05."
        echo "CVE-2022-22706 fix included in this patch level."
        exit $PATCHED
    fi
fi

# Parse Mali driver version string (e.g., "r36p0" or "r35p0")
if [ -n "$MALI_VERSION" ]; then
    # Extract rXXpY format
    DRIVER_VER=$(echo "$MALI_VERSION" | grep -oE 'r[0-9]+p[0-9]+')
    if [ -n "$DRIVER_VER" ]; then
        MAJOR=$(echo "$DRIVER_VER" | sed 's/r\([0-9]*\)p.*/\1/')
        MINOR=$(echo "$DRIVER_VER" | sed 's/r[0-9]*p\([0-9]*\)/\1/')
        # Bifrost/Valhall fixed in r36p0, Midgard fixed in r32p0
        # Conservative check: r36p0+ is safe for all architectures
        if [ "$MAJOR" -ge 36 ] 2>/dev/null; then
            echo "PATCHED - Mali driver version $DRIVER_VER >= r36p0."
            exit $PATCHED
        else
            echo "VULNERABLE - Mali driver version $DRIVER_VER is in the affected range."
            echo "CVE-2022-22706 affects Midgard r26p0-r31p0, Bifrost r0p0-r35p0, Valhall r19p0-r35p0."
            echo "Fixed in Bifrost/Valhall r36p0, Midgard r32p0."
            exit $VULNERABLE
        fi
    fi
fi

# If we only have SPL and it's old
if [ -n "$SPL" ]; then
    echo "VULNERABLE - Android security patch level $SPL is older than 2023-06-05."
    echo "Device likely lacks the CVE-2022-22706 fix. Verify Mali driver version manually."
    exit $VULNERABLE
fi

echo "UNKNOWN - Could not parse Mali driver version from: $MALI_VERSION"
exit $UNKNOWN