High
CVE-2016-10225
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2016-10225
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending “rootmydevice” to /proc/sunxi_debug/sunxi_debug.
Add Assessment
Ratings
-
Attacker ValueHigh
-
ExploitabilityVery High
Technical Analysis
This vulnerability is unbelievably easy to trigger. The binary/process sunxi_debug was accidentally incorporated into kernel builds for Allwinner processors. Simply echoing ‘rootmydevice’ to the process /proc/sunxi_debug/sunxi_debug would elevate the shell to root. Beyond simple, trivial to code, absolutely safe from crashing the device.
There were a few issues though. These devices tend to be cheap and/or obscure such as Dragon Android tablets and Orange Pi thus unlikely to be in non-BYOD enterprise environments. The Android tables also incorporate sandboxing which prevented an app from sending the command to the process.
Would you also like to delete your Exploited in the Wild Report?
Delete Assessment Only Delete Assessment and Exploited in the Wild ReportCVSS V3 Severity and Metrics
General Information
Vendors
- allwinner
Products
- linux-3.4-sunxi -
References
Advisory
Additional Info
Technical Analysis
Report as Emergent Threat Response
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
