CVE-2019-1010221

LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by "adb root" can also be set in a normal adb shell session. The component is: adb shell patches to fix this are at https://review.lineageos.org/c/LineageOS/androidsystemcore/+/234800,...

PT-2019-11516

Name of the Vulnerable Software and Affected Versions: LineageOS versions 16.0 and earlier Description: The issue concerns incorrect access control. It allows an attacker with physical access to exploit the adb shell component by setting a specific property, enabling them to restart adb as root...

CVE-2019-1010221: Undefined Security Weakness

LineageOS 16.0 and earlier is affected by: Incorrect Access Control. The impact is: The property checked by adb root can also be set in a normal adb shell session. The component is: adb shell patches to fix this are at https://review.lineageos.org/c/LineageOS/androidsystemcore/+/234800,...

OnePlus Left A Backdoor That Allows Root Access Without Unlocking Bootloader

Another terrible news for OnePlus users. Just over a month after OnePlus was caught collecting personally identifiable information on its users, the Chinese smartphone company has been found leaving a backdoor on almost all OnePlus handsets. A Twitter user, who goes by the name "Elliot Anderson"...

CVE-2014-7953

Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by running "pm install" with the target apk, and simultaneously running a crafted script to process logcat'...

CVE-2014-7953

CVE-2014-7953 describes a race condition in Android 4.4.4’s ActivityManagerService.bindBackupAgent that lets a local user with adb shell execute code as system by coordinating an adb install with a crafted logcat script to force bindBackupAgent to use an ApplicationInfo uid of 1000. The flaw stem...

CVE-2014-7953

Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by running "pm install" with the target apk, and simultaneously running a crafted script to process logcat'...

PT-2017-6117

Name of the Vulnerable Software and Affected Versions: Android version 4.4.4 Description: A race condition exists in the bindBackupAgent method within the ActivityManagerService in Android. This issue allows local users with adb shell access to execute arbitrary code or install any valid package ...

Android OS 4.4.4 Backup Agent Arbitrary Code Execution Vulnerability

The Android backup agent implementation was vulnerable to privilege escalation and race condition. An attacker with adb shell access could run arbitrary code as the system 1000 user or any other valid package. The attack is tested on Android OS 4.4.4. Android backup agent arbitrary code execution...

CVE-2013-6770

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

CVE-2013-6770

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

CVE-2013-6770: Undefined Security Weakness

The CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.3 and 4.4 does not properly restrict the set of users who can execute /system/xbin/su with the --daemon option, which allows attackers to gain privileges by leveraging ADB shell access and a certain Linux UID, and then...

PT-2014-3197

Name of the Vulnerable Software and Affected Versions CyanogenMod/ClockWorkMod/Koush Superuser package version 1.0.2.1 Description The issue concerns the CyanogenMod/ClockWorkMod/Koush Superuser package, which does not properly restrict the set of users who can execute /system/xbin/su with the...

Android 4.3 Superuser Root Privilege Escalation Vulnerability

The Superuser package for Android 4.3 allows a user to spawn /system/xbin/su with manipulated environment variables to execute code as root. Current releases of the CyanogenMod/ClockWorkMod/Koush Superuser package may allow restricted local users to execute arbitrary commands as root in certain,...

Android 4.3 Superuser Root Privilege Escalation

Current releases of the CyanogenMod/ClockWorkMod/Koush Superuser package may allow restricted local users to execute arbitrary commands as root in certain, non-default device configurations. Android 4.3 introduced the concept of "restricted profiles," created through the Settings - Users menu. A...