feat(CVE-2026-43499): add PD2405 (vivo X200 Pro) target with perf KASLR leak#42
Closed
theVakhovskeIsTaken wants to merge 3 commits into
Closed
feat(CVE-2026-43499): add PD2405 (vivo X200 Pro) target with perf KASLR leak#42theVakhovskeIsTaken wants to merge 3 commits into
theVakhovskeIsTaken wants to merge 3 commits into
Conversation
vr.ko tags every shell/app-origin task in its android_rvh_commit_creds probe
`(sub_8068)` and kills it from the sys_exit tracepoint probe `(sub_8008)` the
moment it runs with euid/fsuid 0. The tag is two bytes plus a thread_info
flag bit:
```
task+0x06 : tag byte A (set to 1 when tagged) [vr sub_8068/sub_8008]
task+0x2c : tag byte B (set to 1 when tagged) [must match byte A;
an out-of-sync pair is itself a kill]
thread_info.flags : bit 0x400 = syscall-tracepoint work bit, set so sys_exit
fires for the task (one below TIF_SECCOMP)
```
Co-authored-by: Lunarixus <Nathan@lunarixus.dev>
Author
|
Result: |
Collaborator
|
Ref: #44 |
Author
|
Noted, thanks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Following PR introduces support for vivo X200 Pro CN (PD2405, 6.6.57-android15-8, OriginOS 5 15.0.27.0, 2025-10-09 SPL)
This PR adds following:
root.cviapick_srcmakefile definition for PD2405, in order to bypassvrthat is used by vivo to kill any process that calls euid/fsuid(0)This has been tested and verified to work on my own device.