Skip to content

Patch 1#2

Open
Yangdongle668 wants to merge 14 commits into
j4nn:masterfrom
Yangdongle668:patch-1
Open

Patch 1#2
Yangdongle668 wants to merge 14 commits into
j4nn:masterfrom
Yangdongle668:patch-1

Conversation

@Yangdongle668

Copy link
Copy Markdown

No description provided.

j4nn and others added 14 commits February 4, 2020 21:34
let's call it bindershell
taken from https://repo.or.cz/cve2019-2215-3.18.git

/*
 * POC to gain arbitrary kernel R/W access using CVE-2019-2215
 * https://bugs.chromium.org/p/project-zero/issues/detail?id=1942
 *
 * Jann Horn & Maddie Stone of Google Project Zero
 * Some stuff from Grant Hernandez to achieve root (Oct 15th 2019)
 * Modified by Alexander R. Pruss for 3.18 kernels where WAITQUEUE_OFFSET is 0x98
 *
 * October 2019
*/
and few more to final stage
kaslr bypass using init_user_ns
also update offsets.c to have init_user_ns there
and add entries for phones with 47.1.A.16.20 firmware
tried to test G8441_47.1.A.2.324, it did not work,
would most likely need some changes in structure offsets,
not worth to debug/analyse further as it works with 16.20 fw
all offsets extracted from kernels from fully downloaded fw releases

G8343_47.1.A.12.150
G8343_47.1.A.12.205
SO-01K_47.1.F.1.105
SO-02K_47.1.F.1.105
SO-04J_47.1.F.1.105
SOV36_47.1.C.9.106
This reverts commit 862e705.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants