Qualcomm Adreno GPU Privilege Escalation (CVE-2025-21479)

CVE-2025-21479 is a high-severity vulnerability (CVSS 8.6) in the Qualcomm Adreno GPU driver firmware, specifically related to the CP_SET_DRAW_STATE command. An exploit has been published that leverages this flaw to achieve arbitrary physical memory write access. On the iQOO Neo9 (running Android 15), this is used to gain kernel-level root access by patching kernel memory to enable full process capabilities (41-bit) while deliberately retaining a non-zero effective UID to bypass manufacturer-specific anti-root detection mechanisms like vr.ko.

Attack Chain

1. An attacker executes a local, user-level binary on the target Android device.
2. The exploit triggers a vulnerability in the Adreno GPU driver (CP_SET_DRAW_STATE).
3. The GPU driver performs an unauthorized SMMU table update (CP_SMMU_TABLE_UPDATE).
4. The attacker achieves arbitrary physical write primitive via a forged page table.
5. The kernel memory is patched to disable kptr_restrict and modify cap_bprm_creds_from_file to preserve capabilities across binary execution.
6. A resident root daemon is spawned, granting full 41-bit capabilities (CapEff) while maintaining euid=2000 to evade anti-root detection.
7. The daemon provides a command execution interface for arbitrary root commands.

Impact

Successful exploitation allows local, unprivileged users or malicious applications to gain full kernel-level capabilities on affected Android devices, bypassing system security policies and manufacturer-specific anti-root protections. The exploit is resident in RAM and does not persist across reboots, but provides full system control while active.

Recommendation

• Monitor for unauthorized binaries being pushed to /data/local/tmp via ADB or other vectors.
• Audit device integrity for signs of active kernel memory modification, particularly those targeting kptr_restrict or capability-related functions.
• Prioritize patching Android devices when OEM firmware updates addressing CVE-2025-21479 become available.
• Restrict ADB access and developer options in production/managed environments to mitigate the initial deployment vector.