cheese

适用于 Quest 3/3S 的 Root 漏洞利用（2025 年 8 月 7 日更新及更早版本），基于 CVE-2025-21479。 Magisk、Cheese 和 Termux 带有 root shell 的截图 警告： Root 是危险的。如果你将 Quest 3/3S 变砖，将无法修复。 此操作在临时 root 状态下会禁用所有安全机制。 不要运行你不可信的应用程序或浏览你不可信的网站。 不要写入 boot 或 system 分区。否则你会变砖。 不要使用 Magisk 的“安装”功能。 你可能希望在 root 后备份你的 deviceKey、Meta Access Token...

CVE-2016-2067

ADRENO GPU IOMMU DMA EXPLOIT Tested under Nexus 6p google/angler/angler:6.0.1/MMB29M/2431559:user/release-keys バグについて 2016年にBlackhat EUで議論されました。 エクスプロイトについて IOMMU DMA書き込みにより、vdso.soがシェルコードで上書きされます。 そのため、/initがkernelclockgettimeを実行した後、シェルコードが実行されます。 /initプロセスはその後、ルートシェルでコネクトバックします。 ログ root@kitploi...

CVE-2020-11179-Adreno-Qualcomm-GPU

P0研究者のBen Hawkesが作成したPoCから発展させた、私の独立した作業です。 元記事: https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html 私の目標は、彼のPoCをC言語に移植し、彼が中断したところから続けて、 PoCをルートシェルまたはカーネルr/wのいずれかに変え、 そして何らかの方法でシステムを変更してカーネルコード実行を示すことです。 おそらく、私のテスト端末ではttbr0へのオフセットが異なる オフセットを見つけるには、計算とデバッグが必要...

cheese-cake

FIX ISSUES :- 1. adapt to samsung device maybe seprate branch add func of finding kernel base using gpu 2. change README 🤝 Contributing Pull Requests PRs are welcome and greatly appreciated! Whether it's fixes, improvements, refactoring, or new device support — feel free to contribute. 🚧 Project...

cheese-cake

修复问题 :- 1. 适配三星设备，可能单独分支添加使用 GPU 查找内核基址的功能 2. 修改 README 🤝 贡献 非常欢迎提交拉取请求（PR）！无论是修复、改进、重构，还是支持新设备，都可以自由贡献。 🚧 项目状态 该项目仍处于开发中（WIP）状态。 我还会添加： 这包括： 其漏洞利用或技术启发了部分实现的研究人员 其代码被改写、引用或修改的开发人员 提供偏移量、补丁或设备特定数据的社区成员 任何贡献了思路或代码片段的开源项目 演示 2025-11-16 15-38-43.webm 📚 参考资料 https://github.com/zhuowei/cheese...

vivo_iqoo_neo_9_root_research_on_CVE-2025-21479

Neo9Root Strumento Caps-Root senza sblocco per iQOO Neo9 PD2338C — schema di privilege escalation con scrittura fisica arbitraria basato su CVE-2025-21479 Adreno GPU SDS Nessuno sblocco del Bootloader, nessun flash, nessun Magisk. Tramite la vulnerabilità GPU si ottiene scrittura fisica arbitrari...

SELinux-Permissive-Only-CVE-2025-21479

SELinux-Permissive-Only-version-of-Cheese-aka-CVE-2025-21479 Questa è, per ora, una versione solo permissiva di SELinux dell'exploit Cheese, noto anche come CVE-2025-21479, che ha colpito il modulo adreno kgsl su molti dispositivi, inclusi i dispositivi Samsung Snapdragon Parte del codice è stata...

cve-2025-21479_iqooneo8

CVE-2025-21479 — Qualcomm Adreno GPU 提权漏洞利用（SM8475 / iQOO Neo8） 针对 CVE-2025-21479 的本地提权实验代码，目标是 vivo V2301A（iQOO Neo8 / PD2301，Snapdragon 8+ Gen 1 / SM8475，Adreno A730，Android 14，GKI 内核 5.10）上的 Qualcomm Adreno GPU（KGSL）。 原理上，漏洞利用通过 KGSL 的 CPSMMUTABLEUPDATE 命令驱动 GPU 的 SMMU， 获得任意物理内存读写 能力，进而关闭...

omae-wa-cheese-da

omae-wa-cheese-da Image Lettura/scrittura fisica arbitraria della GPU CVE-2025-21479 - leak di KASLR - SELinux permissivo - server root con init-hook sicuro contro RKP e bypass di DEFEX per l'esecuzione di binari personalizzati LDPRELOAD Ci vogliono circa 6 minuti... Abbi pazienza. Lo ottimizzerò...

Exploit for Incorrect Authorization in Qualcomm Aqt1000_Firmware

SELinux-Permissive-Only-version-of-Cheese-aka-CVE-2025-21479 T...

SUSE CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

CVE-2026-64154

A flaw was found in the Linux kernel's Adreno graphics processing unit GPU driver. This vulnerability occurs in the a6xxgpuinit function, where a device node reference is not properly released under certain error conditions. This oversight can lead to a gradual accumulation of unreleased resource...

Linux Distros Unpatched Vulnerability : CVE-2026-64049

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace- triggered crash on a2xx-a4xx Before a5xx Adreno driver will n...

CVE-2026-64154

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the common path, several early error returns would bypass this call,...

AZL-92796 CVE-2026-64154 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the common path, several early error returns would bypass this call,...

CVE-2026-64049

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix userspace-triggered crash on a2xx-a4xx Before a5xx Adreno driver will not try fetching UBWC params because those generations didn't support UBWC anyway, however it's still possible to query UBWC-related params...

CVE-2026-64154

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the common path, several early error returns would bypass this call,...

CVE-2026-64154

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the common path, several early error returns would bypass this call,...

CVE-2026-64154 drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the common path, several early error returns would bypass this call,...

CVE-2026-64154 drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix a reference leak in a6xxgpuinit In a6xxgpuinit, node is obtained via ofparsephandle. While there was a manual ofnodeput at the end of the common path, several early error returns would bypass this call,...