Skip to content

feat(CVE-2026-43499): add lamu (Moto G05) target with perf KASLR leak#36

Open
MhmRdd wants to merge 1 commit into
NebuSec:mainfrom
MhmRdd:lamu-perf-kaslr-leak
Open

feat(CVE-2026-43499): add lamu (Moto G05) target with perf KASLR leak#36
MhmRdd wants to merge 1 commit into
NebuSec:mainfrom
MhmRdd:lamu-perf-kaslr-leak

Conversation

@MhmRdd

@MhmRdd MhmRdd commented Jul 11, 2026

Copy link
Copy Markdown

Summary

  • New target lamu-VVTA35.51-28-26 (Motorola Moto G05, 6.6.30-android15-8 GKI). Build ID VVTA35.51-28-26.
  • perf_leak_text_base() in util.c recovers the executable kernel TEXT alias via perf_event_open kernel-IP sampling.
  • Verifications: skips if perf_event_paranoid > 1, filters kernel-text IPs only (drops module IPs below KIMAGE_TEXT_BASE), range-checks the result, and falls back to the slide leak on any failure.
  • main.c uses perf as the main KASLR source with the slide leak as fallback.

@MhmRdd

MhmRdd commented Jul 11, 2026

Copy link
Copy Markdown
Author
IMG_20260711_191934_377

I used a similar device with same cpu/dtb spec for memory layout "Motorola G06 Power" and flashed boot image of Motorola G05 in this to perform the test.

@MhmRdd

MhmRdd commented Jul 11, 2026

Copy link
Copy Markdown
Author

I later tested on real Morotola G05 device and it works as well

@pubglite55

Copy link
Copy Markdown

@MhmRdd
I beg your pardon for taking up your precious time. Would you be so kind as to explain how you exploit this vulnerability? I would be deeply grateful if you could walk me through the detailed workflow and your core line of reasoning behind the exploitation process.

Your valuable guidance would mean a great deal to me. Thank you sincerely for your patience and assistance.

@nebusecurity

Copy link
Copy Markdown
Collaborator

Hi MhmRdd, thanks for the PR!

The code looks great, and we really appreciate the contribution.

We just need a little more time to complete our internal review before merging.

@nebusecurity

Copy link
Copy Markdown
Collaborator

Ref: #44

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Reviewed The changes looks good

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants