Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
cve-2025-21479-iqoo11pro — CVE-2025-21479 (Qualcomm Adreno GPU) reproduction notes for vivo iQOO 11 Pro (PD2254) - authorized research | Kitploit
Tools/GitHubGitHub/xianwan1314/cve-2025-21479-iqoo11pro
Android SecurityPrivilege EscalationVulnerability AnalysisExploitationPost-ExploitationMobile SecurityHardware SecurityPayload DevelopmentBinary Exploitation

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share
GitHubxianwan1314/cve-2025-21479-iqoo11pro

cve-2025-21479-iqoo11pro

CVE-2025-21479 (Qualcomm Adreno GPU) reproduction notes for vivo iQOO 11 Pro (PD2254) - authorized research

View Repository
12642 months agoNot yet reviewed

CVE-2025-21479 Temporary Root (iQOO 11 Series)

Version

ItemValue
Devicevivo iQOO 11 Pro (PD2254 / V2254A)
SystemAndroid 15, PD2254B_A_15.2.12.2.W10
Kernel5.15.178-g3dc7c01077b8-dirty
SoCSnapdragon 8 Gen 2 (SM8550 / kalama)
GPUAdreno 740, OpenGL ES 3.2 [email protected]

Supported Models

ModelFirmwareKernelBinary
iQOO 11 Pro (PD2254)PD2254B_A_15.2.12.2.W105.15.178-g3dc7c01077b8-dirtyexploit_11pro
iQOO 11s (PD2304)PD2304B_A_15.2.12.1.W105.15.178-g844f85161cd7-dirtyexploit_11s
iQOO 11 (PD2243)PD2243B_A_15.2.16.1.W105.15.178-g0ae61da50a34-dirtyexploit_11

Due to limitations of the current method, runtime extraction of kallsyms has not been implemented, so apart from the three versions above, other versions are theoretically incompatible.

Reference Projects

  • zhuowei/cheese (Quest 3/3S, Adreno 740)
  • ma4the/omae-wa-cheese-da (Galaxy Z Flip5, SM8550/Adreno 740 v675)

Implementation Flow

GPU spray (SMMU page table hijack, 27 candidate physical addresses)
  → arbitrary physical memory read/write
  → SELinux enforcing → permissive (physical write to selinux_state)
  → patch __arm64_sys_vhangup (syscall #58, never called on Android)
      GPU directly writes 96-byte stub (commit_creds(prepare_kernel_cred(NULL)))
  → fork child process → syscall(58) → uid=0
  → setexeccon: write /proc/self/attr/exec = "u:r:shell:s0"
  → exec root shell (uid=0, domain = u:r:shell:s0)

Run:

adb push exploit /data/local/tmp/exploit
adb shell
chmod 755 /data/local/tmp/exploit
cd /data/local/tmp && ./exploit

Implementation example

Root privilege management:

find /data/app -type d | grep resukisu
/data/app/***/***/lib/arm64/libksud.so insmod kernelsu.ko

Notes

  • Temporary root: only takes effect in the current shell; exit and re-run the exploit to escalate privileges again
  • GPU spray is a probabilistic process; it may fail when the device is in a poor state—reboot the device and retry
  • Only applicable to Android 15 firmware in the supported models list; other versions are unverified

Disclaimer

This project is intended solely for security research and learning purposes. Please test only on your own devices. Users must bear all consequences arising from the use of this project, including but not limited to device damage and data loss. Do not use this project for any illegal purposes.

Download Tool