{"id":1030,"date":"2026-08-16T23:25:28","date_gmt":"2026-08-16T15:25:28","guid":{"rendered":"https:\/\/blog.nanoturtle.cn\/?p=1030"},"modified":"2026-08-16T23:25:32","modified_gmt":"2026-08-16T15:25:32","slug":"s24-ultra-oneui-root-cve-2026-43499","status":"publish","type":"post","link":"https:\/\/blog.nanoturtle.cn\/index.php\/2026\/08\/16\/s24-ultra-oneui-root-cve-2026-43499\/","title":{"rendered":"S24 Ultra One UI 8.5\u56fd\u884c\u514d\u89e3\u9501 Root \u5b9e\u8df5\uff1a\u57fa\u4e8e CVE-2026-43499 \u7684\u4e34\u65f6\u63d0\u6743\u65b9\u6848"},"content":{"rendered":"
\n\t\t\t\t
<\/div>\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t\t<\/svg><\/span>\n\t\t\t\t\t\u6458\u8981\u751f\u6210\u4e2d<\/span>\n\t\t\t\t\t<\/path><\/svg><\/span>\n\t\t\t\t<\/div>\n\t\t\t\t
\u8bb0\u5f55Samsung Galaxy S24 Ultra\u56fd\u884c\uff08SM-S9280\uff0cOneUI 8.5\uff09\u5229\u7528CVE-2026-43499\u6f0f\u6d1e\u5b9e\u73b0\u514d\u89e3\u9501\u4e34\u65f6Root\u7684\u5b8c\u6574\u8fc7\u7a0b\u3002\u65b9\u6848\u4eceKASLR\u6ed1\u52a8\u6062\u590d\u3001\u7ba1\u9053\u5185\u5b58\u51c6\u5907\u5230\u4f2a\u9020workqueue\u6ce8\u5165\uff0c\u9002\u914d\u4e2d\u9700\u4fee\u6b63\u56fd\u884c\u72ec\u6709\u7684kmalloc_caches\u504f\u79fb\u3001\u6e05\u7406\u6b8b\u7559\u8fdb\u7a0b\u7684\u7ba1\u9053\u914d\u989d\u5360\u7528\u3001\u89e3\u51b3worklist\u7ade\u6001\u5bfc\u81f4panic\u7b49\u95ee\u9898\u3002\u6700\u7ec8\u5c01\u88c5\u4e3a\u4e00\u952e\u8fd0\u884cApp\uff0c\u4e0d\u89e3\u9501bootloader\u3001\u4e0d\u7194\u65adKNOX\uff0c\u4f46\u6bcf\u6b21\u91cd\u542f\u540e\u9700\u91cd\u65b0\u8fd0\u884c\u3002<\/div>
\u2014 AI\u751f\u6210\uff0c\u4ec5\u4f9b\u53c2\u8003<\/span><\/div>\n\t\t\t\t<\/div>\n\t\t\t<\/div>\n

<\/p>\n\n\n\n

\n\n\n\n

<\/p>\n\n\n\n

S24 Ultra \u56fd\u884c\u514d\u89e3\u9501 Root \u5b9e\u8df5<\/h1>\n\n\n\n
\n

\u672c\u6587\u8bb0\u5f55 Samsung Galaxy S24 Ultra\uff08SM-S9280 \u56fd\u884c\uff09\u5728\u4e0d\u89e3\u9501 bootloader\u3001\u4e0d\u7194\u65ad KNOX<\/strong> \u7684\u524d\u63d0\u4e0b\u5b9e\u73b0\u4e34\u65f6 Root \u7684\u5b8c\u6574\u8fc7\u7a0b\uff1a\u4ece\u65b9\u6848\u9009\u578b\u3001\u6f0f\u6d1e\u94fe\u539f\u7406\uff0c\u5230\u9002\u914d\u5185\u6838\u5e38\u91cf\u65f6\u8e29\u8fc7\u7684\u5751\uff0c\u4ee5\u53ca\u6700\u7ec8\u843d\u5730\u4e3a\u53ef\u4e00\u952e\u8fd0\u884c\u7684 Android App \u7684\u7ed3\u679c\u3002<\/p>\n<\/blockquote>\n\n\n\n

\n\n\n\n

\u4e00\u3001\u80cc\u666f\uff1a\u4e3a\u4ec0\u4e48\u9700\u8981”\u514d\u89e3\u9501” Root<\/h2>\n\n\n\n

Samsung \u56fd\u884c\u673a\u578b\u89e3\u9501 bootloader \u7684\u6210\u672c\u6781\u9ad8\uff1a\u89e3\u9501\u5373\u7194\u65ad KNOX e-fuse\uff08\u4e0d\u53ef\u9006\uff09\uff0c\u90e8\u5206\u529f\u80fd\uff08Secure Folder\u3001Samsung Health\u3001Samsung Pay \u7b49\uff09\u6c38\u4e45\u5931\u6548\uff1b\u540c\u65f6 Samsung \u7684 rev bit\uff08SW REV\uff09\u673a\u5236\u8ba9\u964d\u7ea7\/\u81ea\u5b9a\u4e49\u5185\u6838\u53d8\u5f97\u6781\u5176\u56f0\u96be\u2014\u2014\u4e00\u65e6\u5b98\u65b9\u65b0\u56fa\u4ef6\u628a rev bit \u7194\u5230\u66f4\u9ad8\u4f4d\uff0c\u4efb\u4f55\u65e7\u7248\u672c bootloader \u90fd\u65e0\u6cd5\u5237\u56de\u3002<\/p>\n\n\n\n

\u6211\u7684\u8bbe\u5907\u7ecf\u5386\u4e86\u4e00\u8def”\u6298\u817e”:\u4ece rev-4 \u7684 One UI 8.0 \u5f00\u59cb\uff0c\u5237\u5230 8.5 \u540e rev bit \u88ab\u7194\u5230 6\uff0c\u5b98\u65b9 bootloader \u91cd\u65b0\u9501\u5b9a\uff0c\u81ea\u5b9a\u4e49\u5185\u6838\u5168\u90e8\u88ab AUTH \u6821\u9a8c\u62e6\u4e0b\u3002\u6b64\u65f6\u552f\u4e00\u5269\u4e0b\u7684\u8def\u5f84\u5c31\u662f\u5185\u6838\u6f0f\u6d1e<\/strong>\u2014\u2014\u4e0d\u78b0 bootloader\uff0c\u76f4\u63a5\u5728\u8fd0\u884c\u65f6\u63d0\u6743\u3002<\/p>\n\n\n\n

\u4e8c\u3001\u65b9\u6848\u9009\u578b\uff1aCVE-2026-43499<\/h2>\n\n\n\n

\u7ecf\u8fc7\u8c03\u7814\uff0c\u6700\u7ec8\u9009\u62e9 CVE-2026-43499<\/strong>\uff1a\u4e00\u4e2a\u901a\u8fc7\u6d4f\u89c8\u5668\/\u5e94\u7528\u57df\u7ade\u6001\u5b9e\u73b0\u7684\u5185\u6838 RCE\uff0c\u53c2\u8003\u5b9e\u73b0\u5728 Galaxy S24 \u7cfb\u5217\uff08e3q \u5e73\u53f0\uff09\u4e0a\u9a8c\u8bc1\u53ef\u7528\u3002\u6838\u5fc3\u94fe\u8def\uff1a<\/p>\n\n\n\n

    \n
  1. KASLR \u6ed1\u52a8\u6062\u590d<\/strong>\uff1a\u901a\u8fc7 tracefs \u4fa7\u4fe1\u9053\u6062\u590d\u5185\u6838\u57fa\u5740\uff0c\u5b9a\u4f4d\u7b26\u53f7<\/li>\n\n\n\n
  2. \u7ba1\u9053\u5185\u5b58\u51c6\u5907<\/strong>\uff1a\u5229\u7528 pipe \u9875\u91cd\u6392 + mm \u7ed3\u6784\u6cc4\u6f0f\uff0c\u83b7\u5f97\u53ef\u63a7\u7684\u5185\u6838\u5185\u5b58<\/li>\n\n\n\n
  3. CFI\/\u7269\u7406\u5185\u5b58 oracle<\/strong>\uff1a\u901a\u8fc7 fops \u8def\u7531 + \u7ba1\u9053\u9875\u83b7\u5f97\u4efb\u610f\u5185\u6838\u8bfb\u5199<\/li>\n\n\n\n
  4. root \u63d0\u6743<\/strong>\uff1a\u4f2a\u9020 call_usermodehelper<\/code> work \u6ce8\u5165\u7cfb\u7edf workqueue\uff0c\u4ee5 root \u8eab\u4efd\u6267\u884c payload<\/li>\n\n\n\n
  5. KernelSU late-load<\/strong>\uff1a\u4ee5 root \u52a0\u8f7d kernelsu.ko\uff0c\u7531 KernelSU Manager \u63a5\u7ba1 root \u7ba1\u7406\u4e0e\u6a21\u5757\u751f\u6001<\/li>\n<\/ol>\n\n\n\n
    \"\"<\/figure>\n\n\n\n

    \u4e09\u3001\u9002\u914d\u8fc7\u7a0b\u4e2d\u8e29\u8fc7\u7684\u5751<\/h2>\n\n\n\n

    \u6f0f\u6d1e\u94fe\u672c\u8eab\u662f\u516c\u5f00\u7814\u7a76\uff0c\u771f\u6b63\u7684\u5de5\u7a0b\u91cf\u5728\u9002\u914d\u5177\u4f53\u56fa\u4ef6<\/strong>\u3002\u4ee5\u4e0b\u662f\u51e0\u4e2a\u5370\u8c61\u6700\u6df1\u7684\u5751\uff1a<\/p>\n\n\n\n

    1. kmalloc_caches \u504f\u79fb\uff1a\u540c\u5e73\u53f0\u4e0d\u540c\u6784\u5efa\u4e5f\u5929\u5dee\u5730\u522b<\/h3>\n\n\n\n

    e3q \u5e73\u53f0\u7684 S928U1\uff08\u7f8e\u7248\uff09\u4e0e S9280\uff08\u56fd\u884c\uff09\u867d\u7136\u540c\u4e3a 6.1.145 GKI \u5185\u6838\uff0c\u4f46\u6784\u5efa\u53f7\u4e0d\u540c<\/strong>\uff0833419968 vs 3254743\uff09\uff0ckmalloc_caches<\/code> \u7684\u504f\u79fb\u5b8c\u5168\u4e0d\u540c\uff080x176c6f8 vs 0x176cbb8\uff09\u3002\u5e02\u9762\u4e0a\u6d41\u4f20\u7684”\u901a\u7528\u5de5\u5177”\u5f88\u591a\u76f4\u63a5\u5957\u7528\u7f8e\u7248\u504f\u79fb\uff0c\u5bfc\u81f4\u5728\u56fd\u884c\u4e0a 16\/16 \u6b21\u5168\u90e8\u5931\u8d25\u5728\u5185\u5b58\u51c6\u5907\u9636\u6bb5\u3002\u8fd9\u662f\u7b2c\u4e00\u4e2a\u9700\u8981\u4fee\u6b63\u7684\u70b9\u3002<\/p>\n\n\n\n

    2. F_SETPIPE_SZ EPERM\uff1a\u4e0d\u662f\u5185\u6838\u9650\u5236\uff0c\u662f\u6b8b\u7559\u8fdb\u7a0b\u6c61\u67d3\u914d\u989d<\/h3>\n\n\n\n

    exploit \u5728\u51c6\u5907\u7ba1\u9053\u65f6\u9700\u8981\u628a\u7ba1\u9053\u6269\u5bb9\u5230 32 slots\uff0c\u8bbe\u5907\u4e0a\u5374\u53cd\u590d\u51fa\u73b0 F_SETPIPE_SZ: Operation not permitted<\/code>\u3002\u8d77\u521d\u6000\u7591\u662f Samsung \u5185\u6838\u52a0\u4e86\u9650\u5236\uff0c\u53cd\u6c47\u7f16 pipe_fcntl<\/code> \u540e\u786e\u8ba4\u5185\u6838\u903b\u8f91\u5b8c\u5168\u662f\u6807\u51c6\u7684<\/strong>\uff08pipe-max-size 1MB\u3001soft limit 16384 \u9875\u90fd\u6b63\u5e38\uff09\u3002\u6700\u7ec8\u5b9a\u4f4d\uff1a\u4e4b\u524d\u5931\u8d25\u7684 exploit \u5c1d\u8bd5\u7559\u4e0b\u4e86\u4e00\u4e2a cve43499-hold<\/code> \u8fdb\u7a0b\uff0c\u63e1\u7740 480 \u4e2a\u5df2\u6269\u5bb9\u7684\u7ba1\u9053\uff0c\u628a uid 2000 \u7684 pipe_bufs<\/code> \u914d\u989d\u5360\u6ee1\u4e86\u3002kill<\/code> \u6389\u6b8b\u7559\u8fdb\u7a0b\u540e\uff0c\u538b\u529b\u6d4b\u8bd5\u4ece 261 \u4e2a\u7ba1\u9053\u5931\u8d25\u6062\u590d\u5230 400\/400 \u5168\u901a\u8fc7\u3002<\/p>\n\n\n\n

    \"\"<\/figure>\n\n\n\n

    3. worklist \u7ade\u6001\uff1a\u6ce8\u5165 workqueue \u65f6\u7684”\u5b9a\u65f6\u70b8\u5f39”<\/h3>\n\n\n\n

    root \u9636\u6bb5\u628a\u4f2a\u9020 work \u6ce8\u5165 system_unbound<\/code> \u6c60\u7684 worklist \u65f6\uff0c\u5982\u679c\u663e\u793a\u9a71\u52a8\u6070\u597d\u540c\u65f6\u5165\u961f\u771f\u5b9e work<\/strong>\uff0cexploit \u5bf9\u94fe\u8868\u5934\u90e8\u7684\u8986\u76d6\u4f1a\u628a\u771f\u5b9e work \u53d8\u6210”\u5b64\u513f”\u2014\u2014\u5b83\u4fdd\u6301 PENDING \u4f46\u94fe\u8868\u5df2\u65ad\uff0c\u4e0b\u4e00\u6b21 cancel_work_sync<\/code>\uff08\u6bd4\u5982\u5c4f\u5e55\u5237\u65b0\uff09\u5c31\u4f1a\u89e6\u53d1 __list_del_entry_valid<\/code> BUG \u76f4\u63a5 panic\u3002\u8fd9\u6b63\u662f\u591a\u6b21”\u6210\u529f\u62ff\u5230 root \u51e0\u5206\u949f\u540e\u624d\u91cd\u542f”\u7684\u5143\u51f6\u3002<\/p>\n\n\n\n

    \u4fee\u590d\u65b9\u5f0f\uff1a\u6ce8\u5165\u524d\u7acb\u5373\u91cd\u67e5 worklist \u4ecd\u4e3a\u7a7a<\/strong>\uff0c\u82e5\u671f\u95f4\u6709\u771f\u5b9e work \u5165\u961f\u5219\u56de\u6eda\u8ba1\u6570\u5668\u3001\u653e\u5f03\u672c\u6b21\u5c1d\u8bd5\u3002\u52a0\u4e0a\u8fd0\u884c\u671f\u95f4\u7184\u5c4f\uff08\u8ba9\u663e\u793a\u9a71\u52a8\u9759\u9ed8\uff09\uff0c\u8fd9\u4e2a\u5d29\u6e83\u6e90\u57fa\u672c\u5835\u6b7b\u3002<\/p>\n\n\n\n

    4. KDP \u4e0e\u6a21\u5757\u9009\u62e9<\/h3>\n\n\n\n

    Samsung \u5185\u6838\u6709 KDP\/RKP\/DEFEX \u9632\u5fa1\u3002\u666e\u901a GKI \u7684 kernelsu.ko \u5728\u56fd\u884c\u4e0a\u53ef\u4ee5\u52a0\u8f7d\u5e76\u54cd\u5e94\uff08version 32525\uff09\uff0c\u800c\u5b98\u65b9\u53c2\u8003\uff08S928U1\uff09\u4f7f\u7528\u4e86\u6253\u4e86 Samsung KDP \u8865\u4e01\u7684\u53d8\u4f53\u3002\u76ee\u524d\u666e\u901a\u6a21\u5757\u5728\u56fd\u884c\u4e0a\u5de5\u4f5c\u6b63\u5e38\uff0ckdp \u53d8\u4f53\u4f5c\u4e3a\u5907\u9009\u3002<\/p>\n\n\n\n

    \u56db\u3001\u4f7f\u7528\u6d41\u7a0b<\/h2>\n\n\n\n
      \n
    1. \u5b89\u88c5\u5e76\u542f\u52a8 Shizuku\uff08\u65e0\u7ebf\/\u6709\u7ebf ADB \u6388\u6743\uff09<\/li>\n\n\n\n
    2. \u6253\u5f00 App\uff0c\u70b9\u51fb”\u5f00\u59cb Root”\uff08\u5efa\u8bae\u7184\u5c4f\u8fd0\u884c\uff09<\/li>\n\n\n\n
    3. \u7b49\u5f85\u65e5\u5fd7\u51fa\u73b0 \u4e34\u65f6 root \u5df2\u83b7\u5f97<\/code><\/li>\n\n\n\n
    4. \u5b89\u88c5 KernelSU Manager\uff08v3.2.5\uff09\uff0c\u5f3a\u5236\u505c\u6b62\u540e\u91cd\u5f00\uff0c\u663e\u793a”\u5de5\u4f5c\u4e2d \\<LKM> [\u8d8a\u72f1\u6a21\u5f0f]”<\/li>\n\n\n\n
    5. \u6309\u9700\u5b89\u88c5\u6a21\u5757\uff1aZygisk-Next \u2192 LSPosed \u2192 KnoxPatch\uff08Secure Folder \u7b49 KNOX \u529f\u80fd\u56de\u5f52\uff09<\/li>\n<\/ol>\n\n\n\n
      \"\"<\/figure>\n\n\n\n

      <\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n
      \"\"<\/figure>\n\n\n\n
      \"\"<\/figure>\n\n\n\n

      \u4e94\u3001\u6ce8\u610f\u4e8b\u9879<\/h2>\n\n\n\n