Description
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 6 repositories
-
retme7/CVE-2014-7911_poc ★ 150 · Jan 26, 2015
Local root exploit for Nexus5 Android 4.4.4(KTU84P)
-
GeneBlue/cve-2014-7911-exp ★ 12 · Dec 29, 2015
exploit for cve-2014-7911; android; java deserialization ;system privilege;ace;
-
heeeeen/CVE-2014-7911poc ★ 9 · Nov 3, 2015
-
ele7enxxh/CVE-2014-7911 ★ 7 · Jul 3, 2015
-
koozxcv/CVE-2014-7911-CVE-2014-4322_get_root_privilege ★ 2 · Mar 23, 2016
CVE-2014-7911 vulnerability and CVE-2014-4322 vulnerability to get root privilege！
-
koozxcv/CVE-2014-7911 ★ 1 · Mar 22, 2016
vulnerabilities‘ Poc and Exploit
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.