CVE-2014-7911 PoC — Android 权限许可和访问控制漏洞

Source

https://github.com/koozxcv/CVE-2014-7911-CVE-2014-4322_get_root_privilege

Associated Vulnerability

Title: Android 权限许可和访问控制漏洞 (CVE-2014-7911)
Description:luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.

Description

CVE-2014-7911 vulnerability and CVE-2014-4322 vulnerability to get root privilege！

Readme

# CVE-2014-7911_poc
Local root exploit for Nexus5 Android 4.4.4(KTU8P)

author: andy

website: https://blog.csdn.net/koozxcv

# how to build

Import the project into eclipse,and build.

# bug info

http://seclists.org/fulldisclosure/2014/Nov/51

# analysis

http://researchcenter.paloaltonetworks.com/2015/01/cve-2014-7911-deep-dive-analysis-android-system-service-vulnerability-exploitation

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →