Loading vulnerability…
CVE-2020-11179 is a vulnerability in multiple Qualcomm Snapdragon products where a race condition allows an attacker to temporarily overwrite a ring buffer pointer, enabling arbitrary read and write access to kernel addresses. This flaw affects various Snapdragon platforms, including Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, and Wearables.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a proof-of-concept (PoC) local privilege escalation exploit targeting CVE-2020-11179, a race condition in the Qualcomm Adreno GPU driver on Android devices (specifically tested on Google Pixel 4a, Android 10). The exploit is a C-language port and extension of Ben Hawkes' original Project Zero PoC, aiming to achieve kernel code execution by corrupting the sys_call_table via GPU ringbuffer manipulation and page table setup. The main files are 'adrenaline.c' (exploit logic), 'adrenaline.h' (structures and constants for interacting with the GPU driver), and 'run.sh' (build and deploy script). The exploit requires local shell access and leverages /proc/iomem and /proc/kallsyms to calculate kernel addresses. The current state is a PoC: it demonstrates the vulnerability and partial control over kernel memory, but does not yet provide a full root shell or arbitrary kernel read/write. The Makefile is configured for cross-compilation targeting Android ARM64. The repository is structured for research and further development towards a full exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
1 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.