what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Android One Privilege Escalation

Posted Mar 25, 2016

Authored by Google Security Research, Mark Brand

The wireless driver for the Android One (sprout) devices has a bad copy_from_user in the handling for the wireless driver socket private read ioctl IOCTL_GET_STRUCT with subcommand PRIV_CMD_SW_CTRL. This ioctl is permitted for access from the untrusted-app selinux domain, so this is an app-to-kernel privilege escalation from any app with android.permission.INTERNET.

tags | exploit, kernel

systems | linux

SHA-256 | f09afcb089991f9bdfe7878694f1b4aa53a78b0716b0db1d420fbf8364088819

Download | Favorite | View

Related Files

No related files