Low Severity
CVE-2022-22706
Published: Oct 28, 2026
Kernel root exploit & boot persistence research on Sony Bravia Android TV (MT5890): CVE-2022-22706 page-cache write, targeted setresuid hook, and persistent root console
<p align="center">
<img src="assets/hero.png" alt="Sony BRAVIA XBR-65X850D Root & Persistence Research" width="100%">
</p>
<p align="center">
<a href="https://android.com"><img src="https://img.shields.io/badge/Device-Sony%20XBR--65X850D%20(SVP--DTV15)-blueviolet?style=for-the-badge&logo=sony" alt="Device"></a>
<a href="https://www.mediatek.com"><img src="https://img.shields.io/badge/SoC-MediaTek%20MT5890-orange?style=for-the-badge&logo=arm" alt="SoC"></a>
<a href="https://developer.android.com/about/versions/oreo"><img src="https://img.shields.io/badge/OS-Android%208.0.0%20(Build%206.827)-brightgreen?style=for-the-badge&logo=android" alt="Android"></a>
<a href="https://kernel.org"><img src="https://img.shields.io/badge/Kernel-Linux%203.10.79%20armv7l-blue?style=for-the-badge&logo=linux" alt="Kernel"></a>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2022-22706"><img src="https://img.shields.io/badge/Primitive-CVE--2022--22706%20Page--Cache%20Write-critical?style=for-the-badge&logo=target" alt="CVE"></a>
<a href="tools/rootconsole.ps1"><img src="https://img.shields.io/badge/Persistence-Port%204445%20(uid%3D0)-success?style=for-the-badge&logo=powershell" alt="Status"></a>
</p>
---
## 1. Executive Summary & Problem Space
Consumer embedded appliances routinely reach end-of-support while remaining active daily-driver devices in living rooms. The **Sony Bravia XBR-65X850D** (board platform `SVP-DTV15`, MediaTek `MT5890` SoC) received its final system firmware upgrade to Android 8.0.0 Oreo (`OPR2.170623.027.S16`, release `6.827`) in early 2020. The Android Security Patch Level (SPL) was frozen at **2020-01-01** and never patched again.
Standard device hardening enforces strict hardware and OS-level boundaries:
* **Hardware & Bootloader**: `ro.boot.flash.locked=1`, `ro.secure=1`, `ro.debuggable=0`, and kernel `dm-verity` cryptographically seal `/system` against offline modification.
* **Storage Protection**: `/data` is mounted `nosuid`, neutralizing