Man Yue Mo: Gaining kernel code execution on an MTE-enabled Pixel 8

Man Yue Mo explainshow to compromise a Pixel8 phone even when the Arm memory-tagging extension is in use, by takingadvantage of the Mali GPU.

So, by using the GPU to access physical addresses directly, I'mable to completely bypass the protection that MTEoffers. Ultimately, there is no memory safe code in the code thatmanages memory accesses. At some point, physical addresses willhave to be used directly to access memory.