HighPublic exploitVulnerability

CVE-2015-1805

Linux kernel pipe I/O vector array overrun

Published Aug 8, 2015 · Updated 24 days ago

Trending this weekNot trendingOutside this week’s top 100

Mention activity · 30 daysNo mention activity in the last 30 days.

CVSS7.2High · v2

EPSS1.4%73rd percentile

CISA KEVNoNot listed

In the wildReported2 exploitation records in Mallory

Vendors: GoogleLinux

IdentifiersCVE-2015-1805CWE-119

CVE-2015-1805 is an I/O vector array overrun vulnerability in the Linux kernel before version 3.16. The pipe_read and pipe_write implementations incorrectly handle the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls. A crafted local application can trigger a system crash or escalate privileges, including executing arbitrary code in the kernel on affected Android devices. Unpatched Android kernels 3.4, 3.10, and 3.14 are affected; Android devices using kernel version 3.18 or higher are not vulnerable.

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Analyst brief

Impact, mitigation & remediation

What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can crash the operating system or grant an application kernel-level code execution and root privileges. On Android, exploitation can result in persistent device compromise requiring operating-system re-flashing to recover. Public rooting tools demonstrated exploitation on Nexus 5 and Nexus 6, and an AndroRAT variant subsequently used the vulnerability for privileged malicious activity.

Mitigation

If you can’t patch tonight, do this now.

Google updated Verify Apps to detect and block known applications exploiting this vulnerability, including applications installed outside Google Play. Google Play also prohibits rooting applications of the type used in the confirmed exploitation. These controls do not replace installation of the kernel security fix.

Remediation

Patch, then assume compromise.

Apply a vendor-provided kernel or device security update containing the fix. The upstream Linux correction was released in April 2014, and Google released Android fixes for kernel branches 3.4, 3.10, and 3.14 in March 2016. Android security patch levels March 18, 2016, or April 2, 2016 and later indicate protection. A compromised Android device may require operating-system re-flashing to recover.

Public exploits

Exploits

3 exploits validated by Mallory's analysis. Hidden: 1 not yet analyzed, such as Exploit-DB entries.

View more in app →

iovyrootThis repository implements a local privilege escalation exploit for Android devices vulnerable to CVE-2015-1805, a kernel vulnerability in the pipe buffer handling code. The exploit is written in C and is intended to be built as a native binary for Android (using the NDK build system). The main entry point is jni/main.c, which orchestrates the exploitation process: it fingerprints the device and kernel version using /system/build.prop and /proc/version, selects the appropriate hardcoded kernel offsets from jni/offsets.c, and then performs a series of heap sprays, memory mappings, and pipe operations to overwrite kernel structures. The exploit ultimately modifies the process's credentials in kernel memory to gain root privileges, disables SELinux enforcement, and spawns a root shell (/system/bin/sh) or executes arbitrary commands as root. The exploit is operational and requires the target device to match one of the supported models and kernel versions. The codebase is well-structured, with separate files for kernel structure definitions, offset management, and the main exploit logic. No network endpoints are targeted; the attack vector is purely local, requiring code execution on the device.dosomder · Disclosed Apr 1, 2016 · c · make · localOperational Android-Privilege-Escalation-Remote-Access-Vulnerability-CVE-2015-1805This repository contains a Python script ('androRaT.py') and a README describing an exploit for CVE-2015-1805, a privilege escalation vulnerability affecting older Android devices. The script allows the attacker to build a malicious APK that, when installed on a vulnerable device, provides a remote shell with escalated privileges. The script supports both direct IP/port connections and the use of ngrok for tunneling, making remote exploitation feasible even behind NAT or firewalls. The README provides context about the vulnerability and the exploit's purpose. The repository is operational, providing a working exploit and payload, but is not part of a larger exploitation framework.ireshchaminda1 · Disclosed Feb 12, 2023 · python · networkOperational hp-slate7-root-kitThis repository is a real, device-specific local privilege-escalation kit for HP Slate 7 2800 tablets. It targets CVE-2015-1805 in the Linux kernel pipe/iovec handling and is not a generic Android root tool. The repo contains Bash helper scripts, C exploit sources, a C installer, and a tiny ARM assembly su wrapper. The main exploit path is: scripts/root-device.sh verifies the target via ADB, checks SHA256 hashes, pushes three binaries into /data/local/tmp, and runs the exploit. src/exploit/root-main.c calls iov_main() from src/exploit/expIov/iov_exp_main.c, which implements the race condition using pipes, readv(), mmap/munmap churn, and a loopback UDP sendmmsg-based heap spray. On success, getroot() temporarily overwrites syscall table entry 222 with a naked ARM trampoline that patches addr_limit/current thread context, invokes the syscall, restores the original syscall pointer, and then uses arbitrary kernel read/write helpers to locate and overwrite the current task's cred structure, zeroing UID/GID fields and setting capability bitmaps to all ones. After root is obtained, the exploit execs /data/local/tmp/install-root. The installer remounts /system read-write, copies the uploaded rootsh-armv7 binary to /system/xbin/su, sets ownership to root and mode 06755, syncs, and remounts /system read-only. The installed su wrapper simply sets resgid/resuid to 0 and execves /system/bin/sh, yielding persistent root shell access. Repository structure is clean and purposeful: scripts/ contains build, target-check, and deployment helpers; src/exploit/common contains symbol lookup, syscall-table discovery, and credential modification logic; src/exploit/expIov contains the CVE trigger and race machinery; src/installer contains the persistence installer; src/su contains the minimal su payload. There are no external C2 or remote network targets beyond local loopback UDP used internally by the exploit.valentineus · Disclosed Aug 18, 2026 · c · assembly · local · fileOperational

Exposure surface

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

GoogleAndroidoperating_system

LinuxLinux Kerneloperating_system

External references

References

MITRE CVEcve.org · CVE-2015-1805 NVDnvd.nist.gov/vuln/detail/CVE-2015-1805 MITRE CWE · CWE-119cwe.mitre.org git.kernel.orggit.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=637b58c2887e5e57850865839cc75f59184b23d1 git.kernel.orggit.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f0d1bec9d58d4c038d0ac958c9af82be6eb18045 lists.opensuse.orglists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html lists.opensuse.orglists.opensuse.org/opensuse-security-announce/2015-07/msg00049.html lists.opensuse.orglists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html lists.opensuse.orglists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html lists.opensuse.orglists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html lists.opensuse.orglists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html lists.opensuse.orglists.opensuse.org/opensuse-security-announce/2015-09/msg00010.html +27 more referencesview more in app

Activity feed

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

View more in app →

trendai security blogNews · Aug 26, 2026New AndroRAT Exploits Allow for Permanent Rooting | TrendAI (US)An Android privilege-escalation vulnerability affecting older, unpatched devices. The ANDROIDOS_ANDRORAT.HRXC AndroRAT variant embeds and executes a root exploit for this flaw to obtain elevated privileges and conduct covert surveillance and device-control actions.Read more ↗

Do you run this?See affected versions in your environment and whether adversaries are exploiting this vulnerability against assets like yours.

Check your exposure

Mallory platform

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, and which detections to deploy tonight.

Start Free Trial Open in App ↗

Exposure mappingQuery your assets running an affected version, and investigate the blast radius.

Threat actor evidenceEvery report linking this CVE to a named adversary.

Associated malware2Malware families linked to this CVE, with evidence and IOCs.

Detection signaturesYARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mappingCross-references every affected SKU, including bundled OEM variants.

Social activityCommunity discussion across Reddit, Mastodon, and other social sources.