SELinux-Permissive-Only-version-of-Cheese-aka-CVE-2025-21479

This is an SELinux permissive only version, for now, of the Cheese exploit also known as CVE-2025-21479 which affected the adreno kgsl on many devices including Samsung snapdragon devices

Some of the code has been recycled from the following repos and I would like to thank zhuowei for originally getting the proof of concept off the ground and sarabpal-dev for keeping a well maintained and active repository

https://github.com/sarabpal-dev/cheese-cake

I decided to take on this project as a bit of a challenge and because I've never got into anything this complex before so it was a good learning experience even though it's not done yet. What I originally wanted to do was see if the whole chain could be done from a truly untrusted domain directly in the termux environment. I've managed to achieve SELinux permissive so far without the use of adb, shrunk the code to about a quarter of the original size, it's stable and usually takes less than a minute from start to finish and it's on my Samsung SM-S901W S22 Snapdragon with locked bootloader. I just haven't dug into the root primitive yet and I'm not sure if that could be done without adb, but I'm still going to try. I hope this inspires people to try to do things that typically people say can't be done, maybe someone will have an idea that will work. Feel free to open an issue as I'm open to any helpful contribution.

TUTORIAL

This exploit is really easy and theres barely any editing to the code you would need to do in order to get it running on your device. All you need to do is:

git clone the repo and cd to it
grab the boot.img from your exact firmware
use unpack_bootimg (it's already in termux) to extract your kernel out of it
compile the extract-kallsyms.c binary and run it on your kernel
take your kallsyms.txt and place it directly in the path you're going to be executing the exploit from
compile with cc -o gpu_sam gpu_sam.c -ldl
it will dynamically go through your kallsyms.txt while it's running to find all the necessary offsets
the only things you'll have to change depending on your device are the following values for the kernel base scan const uint64_t candidates[] = { 0xC0000000, 0xE0000000 }; and for (uint64_t addr = 0xa8000000; addr < 0xa8500000; addr += 0x8000) {
if all goes well you should have stable selinux permissive from a regular termux shell

NOTES

There will always be a risk of an smmu fault or kernel panic but this works very nicely on my phone with kernel 5.10.168 and rarely do I get a crash. You might have to run it a couple times or even reboot to reset the GPU state. I made this to be as user friendly as possible. The video below is just a quick demo, I already was permissive. Enjoy

https://github.com/user-attachments/assets/63d0dfa7-1390-41ce-96da-9c34d8a220ec

SELinux-Permissive-Only-CVE-2025-21479

Most Popular