important · Privilege — Android
Any Android app can become root on kernels using affected FolkPatch releases.
Affects
FolkPatch, an Android rooting project that patches device kernels with a custom KernelPatch fork.
The app invokes FolkPatch's retained supercall interface with the public hardcoded SuperKey "su," and the kernel executes its requested command as root.
Detail and 4 sources
Working code is public, the proposed random-key mitigation was not merged, and no fixed official release was identified.
Sources
Code / PoC默认将superkey固定为"su"导致的任意进程提权 · Issue #142 · LyraVoid/FolkPatch · GitHubCode / PoCRandomly generate a superKey by 1q23lyc45 · Pull Request #207 · LyraVoid/FolkPatch · GitHubPatchrefactor: align auth with upstream APatch, remove custom SuperKey scheme · LyraVoid/FolkPatch@09b6dcb · GitHubSecondaryLocal Privilege Escalation (LPE) in FolkPatch due to Hardcoded Default SuperKey