CVE-2015-0572

HIGH

Linux Kernel 3.0-3.19.8 - Race Condition in ADSPRPC Driver via COMPAT_FASTRPC_IOCTL_INVOKE_FD

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2015-0572. PoCs published by ScottyBauer.

AI-analyzed exploit summary This PoC exploits a race condition in the Android kernel's fastrpc driver (CVE-2015-0572) by manipulating stack memory during ioctl operations, leading to arbitrary kernel memory corruption. The exploit uses pthreads to race against the ioctl call, overwriting kernel structures with controlled values.

Description

Multiple race conditions in drivers/char/adsprpc.c and drivers/char/adsprpc_compat.c in the ADSPRPC driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (zero-value write) or possibly have unspecified other impact via a COMPAT_FASTRPC_IOCTL_INVOKE_FD ioctl call.

Exploits (1)

github WORKING POC 682 stars

by ScottyBauer · cpoc

https://github.com/ScottyBauer/Android_Kernel_CVE_POCs/tree/master/CVE-2015-0572.c

View Code ZIP pw:eip

This PoC exploits a race condition in the Android kernel's fastrpc driver (CVE-2015-0572) by manipulating stack memory during ioctl operations, leading to arbitrary kernel memory corruption. The exploit uses pthreads to race against the ioctl call, overwriting kernel structures with controlled values.

Classification

Working Poc 95%

Attack Type

Lpe

Complexity

Complex

Reliability

Racy

Target: Android kernel (fastrpc driver)

No auth needed

Prerequisites: Access to /dev/adsprpc-smd device node

MITRE ATT&CK

T1068 - Exploitation for Privilege Escalation T1548 - Abuse Elevation Control Mechanism

devstral-2 · analyzed Feb 27, 2026 Full analysis →

References (5)

Core 5

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/93312

Broken Link x_refsource_confirm

https://www.codeaurora.org/race-condition-leading-arbitrary-null-write-adsp-using-ioctl-compatfastrpcioctlinvokefd-cve-2015

Patch, Vendor Advisory x_refsource_confirm

http://source.android.com/security/bulletin/2016-10-01.html

Mailing List, Patch, Third Party Advisory x_refsource_confirm

https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=34ad3d34fbff11b8e1210b9da0dac937fb956b61

Mailing List, Patch, Third Party Advisory x_refsource_confirm

https://source.codeaurora.org/quic/la/kernel/msm/commit/?id=8fb32c3a8147b82e2bb159b3f70d803c9e68899b

Scores

CVSS v3 7.0

EPSS 0.0029

EPSS Percentile 20.2%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-362

Status published

Products (1)

linux/linux_kernel 3.0 - 3.19.8

Published Oct 10, 2016

Tracked Since Feb 18, 2026