Low Severity
CVE-2022-22706
Published: Oct 25, 2026
Root & persistence research on a Sony XBR-65X850D / SVP-DTV15 (MT5890, Android 8.0): CVE-2022-22706 page-cache write -> targeted setresuid patch -> reboot-surviving uid-0 root console
<h1 align="center">Sony XBR-65X850D — Root & Persistence</h1>
<p align="center">
<em>Local privilege escalation, root shell and reboot-surviving persistence on a<br>
Sony Bravia 4K Android TV (SVP-DTV15 / MediaTek MT5890) that never received a security patch after 2020.</em>
</p>
<p align="center">
<img alt="device" src="https://img.shields.io/badge/device-XBR--65X850D-blueviolet">
<img alt="soc" src="https://img.shields.io/badge/SoC-MediaTek%20MT5890-orange">
<img alt="android" src="https://img.shields.io/badge/Android-8.0.0%20(6.827)-brightgreen">
<img alt="kernel" src="https://img.shields.io/badge/kernel-3.10.79%20armv7-lightgrey">
<img alt="selinux" src="https://img.shields.io/badge/SELinux-enforcing-red">
<img alt="cve" src="https://img.shields.io/badge/CVE--2022--22706-exploited-critical">
<img alt="status" src="https://img.shields.io/badge/root-uid%200%20%C2%B7%20persistent-success">
</p>
---
## TL;DR
This TV ships with **`ro.debuggable=0`**, **`ro.boot.flash.locked=1`**, verified boot, an
enforcing SELinux policy and a security patch level of **2020-01-01**. Every conventional
root path (firmware downgrade, USB update, UART, setuid binaries) is closed.
It was rooted anyway, using a public but **never-applied** kernel driver bug:
1. **CVE-2022-22706** in the Mali `kbase` driver gives an *arbitrary page-cache write*
from plain ADB shell (uid 2000).
2. That write is used to patch **`libc.so`'s `setresuid`** so that exactly one app keeps
`uid 0` instead of dropping privileges.
3. The patcher is compiled into that app as a **JNI library**, and a **persisted
JobScheduler job** re-applies it on every boot.
4. The app then re-launches itself, becomes the only `uid 0` process on the device, and
exposes a **TCP root console** — reachable over LAN or Tailscale.
**Verified result:** after a clean reboot, with *zero* manual steps, a remote shell reports
`uid=0(root)` on the TV. The rest of the system is untouched and keeps runnin