QSEECOM ioctl Input Validation Vulnerability

This repository is a proof-of-concept (PoC) exploit for CVE-2014-4322, targeting the QSEECOM driver on Nexus devices running Android 4.4 (KitKat) and 5.0 (Lollipop). The exploit is written in C and ARM assembly, with build scripts for the Android NDK. The main exploit logic resides in 'jni/msm.c', which interacts with device files such as '/dev/ptmx' and '/dev/ion' to manipulate kernel memory and escalate privileges. The exploit must be run with system privileges and in a specific SELinux context. Upon successful exploitation, it grants root privileges and changes the SELinux context to 'kernel', effectively giving the attacker full control over the device. The repository includes kernel structure definitions and QSEECOM ioctl definitions to facilitate the exploit. No network endpoints are present; the attack vector is purely local privilege escalation.

This repository contains a proof-of-concept (POC) local privilege escalation exploit for CVE-2014-4322, targeting vulnerable Android devices. The main exploit logic is implemented in 'Feud/jni/main.c', which interacts with the QSEECOM and ION kernel drivers via device files '/dev/qseecom' and '/dev/ion'. The exploit works by mapping large memory regions, manipulating ION buffers, and using QSEECOM IOCTLs to overwrite kernel memory, specifically targeting the PPPOLAC protocol release function pointer. If successful, it allows arbitrary code execution in kernel space, effectively granting root or kernel-level privileges. The repository includes relevant kernel header files (ion.h, qseecom.h, symbols.h) and a Makefile for building the exploit as a shared library. The exploit is not weaponized and does not include a customizable payload, but demonstrates the core technique for achieving kernel code execution. The attack vector is local, requiring code execution on the target device.