Type010

GitHub · Repository owner · Source ID 229056701
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

Type010/cve-2025-21479-iqoo11pro

Repository PoC0Created 2026-08-13WriteupCVE-2025-214792 files

35.3 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A technical writeup documenting the process of porting and executing a temporary root exploit for CVE-2025-21479 on a vivo iQOO 11 Pro. The document details the vulnerability, target device, porting steps, and verification results, but the exploit binary itself is explicitly not provided.

Backdoor review

Backdoor review undetermined

The repository contains a README.md documenting a local privilege escalation exploit for CVE-2025-21479 and a binary file 'payload withheld' which is the compiled exploit payload. The README explicitly states the binary is delivered without source code. The behavior of the binary, including any potential backdoor or deceptive functionality, cannot be reviewed because its contents are uninspected binary data. No positive evidence of a backdoor or deception is present in the readable documentation, but the critical executable behavior is entirely omitted from the reviewable evidence.

ClassificationWriteup
Model confidence95%
AuthenticationNot required
LanguagesChinese
Target softwareQualcomm Adreno GPU firmware (a740_sqe.fw)Android 15Linux kernel 5.15
Attack typesprivilege escalationmemory corruption
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a README.md file that provides a detailed technical analysis of the vulnerability, the porting process, and verification results. It explicitly states the exploit binary 'payload withheld' is a 'binary delivery, source code not public' and is not included as readable text. The packet metadata confirms the binary is flagged and not analyzed, and the analysis routing classifies the artifact as 'NO_POC_CODE_IDENTIFIED'. This constitutes a writeup without executable exploit or scanner code.

README.md:107README.md:1-119

Requirements

  • Target device must be a vivo iQOO 11 Pro running Android 15 (PD2254B_A_15.2.12.2.W10) with vulnerable Adreno 740 GPU firmware v675.README.md:17-21
  • The compiled exploit binary 'payload withheld' must be pushed to the device and executed.README.md:78-80

Observed behavior

  • The exploit achieves arbitrary physical memory read/write by exploiting a GPU firmware vulnerability.README.md:9
  • It bypasses SELinux by physically overwriting selinux_state.enforcing to 0.README.md:45
  • It grants full capabilities to the process while keeping uid=2000 to evade a vivo root-detection watchdog.README.md:47
  • The result is a root shell with full capabilities and SELinux in permissive mode.README.md:69-72
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Binary File
Payload withheldThe compiled exploit payload for CVE-2025-21479, described as a binary delivery with no source code available. Its behavior cannot be analyzed from the provided evidence.README.md:107
Review boundaries

What the analysis did not establish

  • The exploit binary 'payload withheld' is present in the repository but is a binary file that was not analyzed; its source code is not provided.
  • The analysis is based solely on the README.md writeup; the actual exploit code was not inspected or executed.
  • The 'payload withheld' binary (sha256:dc7b0588353381042a6e421b47360431f729739fca260d7730be09b8a044317a) is the core exploit payload and is uninspected. Its behavior, including any potential backdoor, cannot be determined from the provided evidence.
  • The review is limited to the README.md documentation; no source code for the exploit is available for analysis.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.