BRW-GPU-IOCTLPrivilege Escalation

GPU Process Driver IOCTL Escape

Renderer talks to the GPU process; GPU process talks to a vulnerable kernel driver — chain ends in kernel RCE from a web page.

§ Where this technique fits

BRW-GPU-IOCTL is catalogued under the Privilege Escalation tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

Renderer compromise → GPU process → vulnerable kernel driver
After renderer RCE, talk to the GPU process via IPC. GPU process sends ioctls to a vulnerable graphics driver — full kernel R/W; ring0 from a web page.
step 3 / 5

§ What commonly comes next

01
BYOVD — Bring-Your-Own-Vulnerable-Driver
EDR-BYOVD · Defense Evasion
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Renderer compromise → GPU process → vulnerable kernel driver

§ What commonly comes next