{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3oqualcommsm7675p_firmware-/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:o:qualcomm:aqt1000_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:fastconnect_6200_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:fastconnect_6700_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:fastconnect_6900_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:fastconnect_7800_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:fastconnect_6800_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:qca6391_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:qcm4490_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:qcs4490_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sd855_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm4635_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm6250_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm6650_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm6650p_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm7325p_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm7635_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm7675_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm8550p_firmware:-:*:*:*:*:*:*:*","cpe:2.3:o:qualcomm:sm8635_firmware:-:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2025-21479"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["iQOO Neo9 (Android 15)","Qualcomm aqt1000 Firmware (All versions)"],"_cs_severities":["high"],"_cs_tags":["privilege-escalation","android","vulnerability","mobile-security"],"_cs_type":"advisory","_cs_vendors":["Vivo","Qualcomm"],"content_html":"\u003cp\u003eCVE-2025-21479 is a high-severity vulnerability (CVSS 8.6) in the Qualcomm Adreno GPU driver firmware, specifically related to the \u003ccode\u003eCP_SET_DRAW_STATE\u003c/code\u003e command. An exploit has been published that leverages this flaw to achieve arbitrary physical memory write access. On the iQOO Neo9 (running Android 15), this is used to gain kernel-level root access by patching kernel memory to enable full process capabilities (41-bit) while deliberately retaining a non-zero effective UID to bypass manufacturer-specific anti-root detection mechanisms like \u003ccode\u003evr.ko\u003c/code\u003e.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker executes a local, user-level binary on the target Android device.\u003c/li\u003e\n\u003cli\u003eThe exploit triggers a vulnerability in the Adreno GPU driver (CP_SET_DRAW_STATE).\u003c/li\u003e\n\u003cli\u003eThe GPU driver performs an unauthorized SMMU table update (CP_SMMU_TABLE_UPDATE).\u003c/li\u003e\n\u003cli\u003eThe attacker achieves arbitrary physical write primitive via a forged page table.\u003c/li\u003e\n\u003cli\u003eThe kernel memory is patched to disable \u003ccode\u003ekptr_restrict\u003c/code\u003e and modify \u003ccode\u003ecap_bprm_creds_from_file\u003c/code\u003e to preserve capabilities across binary execution.\u003c/li\u003e\n\u003cli\u003eA resident root daemon is spawned, granting full 41-bit capabilities (CapEff) while maintaining euid=2000 to evade anti-root detection.\u003c/li\u003e\n\u003cli\u003eThe daemon provides a command execution interface for arbitrary root commands.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows local, unprivileged users or malicious applications to gain full kernel-level capabilities on affected Android devices, bypassing system security policies and manufacturer-specific anti-root protections. The exploit is resident in RAM and does not persist across reboots, but provides full system control while active.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor for unauthorized binaries being pushed to \u003ccode\u003e/data/local/tmp\u003c/code\u003e via ADB or other vectors.\u003c/li\u003e\n\u003cli\u003eAudit device integrity for signs of active kernel memory modification, particularly those targeting \u003ccode\u003ekptr_restrict\u003c/code\u003e or capability-related functions.\u003c/li\u003e\n\u003cli\u003ePrioritize patching Android devices when OEM firmware updates addressing CVE-2025-21479 become available.\u003c/li\u003e\n\u003cli\u003eRestrict ADB access and developer options in production/managed environments to mitigate the initial deployment vector.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-24T00:02:34Z","date_published":"2026-10-24T00:02:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-vivo-iqoo-neo9-root-cve-2025-21479/","summary":"CVE-2025-21479 is a high-severity local privilege escalation vulnerability in the Qualcomm Adreno GPU driver allowing for kernel-level arbitrary physical memory writes, with functional exploits now targeting Android devices including the iQOO Neo9.","title":"Qualcomm Adreno GPU Privilege Escalation (CVE-2025-21479)","url":"https://feed.craftedsignal.io/briefs/2026-10-vivo-iqoo-neo9-root-cve-2025-21479/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:o:qualcomm:sm7675p_firmware:-:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}