
Title:Local root exploit on Android 4.4.4

Author: 
retme (retme7@gmail.com) @returnsme on twitter.com,@retme on weibo.com

homepage:
https://github.com/retme7

Related CVE Number: 
CVE-2014-7911,CVE-2014-4322

Description: 
A local application may gain system privilege by CVE-2014-7911,and then gain root by CVE-2014-4322.
Here is an exploit working on Nexus 5,Android 4.4.4(KTU8P).The exploit may works on you own device with Qualcomm soc and Android < 5.0 only if you modify the offsets of rop chain.

How-to-build:

1.build APK

import ./CVE-2014-7911_poc/cve20147911 into eclipse workspace,build with Android sdk.

2.build ./CVE-2014-7911_poc/cve20147911/asserts/msmattack

msmattack is the binary of file of CVE-2014-4322,you can build it with Android ndk:

$ cd ./CVE-2014-4322_poc
$ ndk-build


Details about CVE-2014-7911:
http://seclists.org/fulldisclosure/2014/Nov/51
http://researchcenter.paloaltonetworks.com/2015/01/cve-2014-7911-deep-dive-analysis-android-system-service-vulnerability-exploitation

Details about CVE-2014-4322:
https://www.codeaurora.org/projects/security-advisories/memory-corruption-qseecom-driver-cve-2014-4322