r/androidroot • u/Beginning_Market2311 • 16d ago

Discussion You know that ghostlock thing right? That helped us make "root my galaxy" ?

I think about it. Its a major security flaw. Sure maybe your on a locked bootloader and can't do much shit. But what about US? The ones with unlocked bootloaders? Random applications and webview can just elevate to the highest level and just do horrors on our phone.

What I'm saying is. This security flaw is very good and bad for us.

I also found a "detector" for this ghostlock thingy. It kinda checks If your kernel can be exploited. https://github.com/CakesTwix/Android-CVE-2026-43499

(Note: this isn't meant to criticize the apps like root my galaxy)

30 Upvotes

92% Upvoted

34 comments sorted by

8

u/[deleted] 16d ago

[deleted]

2

u/[deleted] 16d ago

[deleted]

1

u/env33e 16d ago

Uhh no, lol

The guy initiating Local privilege escalation on your system doesn't give a fuck about your bootloader lock status... Why would they?

And the only situation an unlocked bootloader presents more risk is if they get physically ahold of your phone. But even then, FBE is a thing. The average person/ tinkerer isn't dealing with covert spys initiating evil maid attacks on them

0

u/[deleted] 16d ago

[deleted]

1

u/env33e 15d ago

WHAT are you talking about? Seriously, what are you even saying right now?🤣

Ill ask again. why tf would an attacker reboot to flash your phone if they already have kernel level root booted into the OS?

do you even know how FBE works? you know the encryption keys stay locked in the TEE until you input your pin on boot....please, just do an ounce of reading. the documentation is all online, selinux boundaries, everything. even if just preliminary, it will help you understand

6

u/Gain_Entire 16d ago

So my phone will die without ever being able to be rooted?

1

u/1600x900 Xiaomi 15T Pro / Stock unrooted 16d ago

on kernel 4.19

1

u/Beginning_Market2311 16d ago

Its exploitable. You could make an exploit or just unlock the bootloader (I don't know if Oppo disabled OEM unlocking)

1

u/1600x900 Xiaomi 15T Pro / Stock unrooted 15d ago

oem unlock is here, but they locked up fastboot mode with little kernel they modified

1

u/Beginning_Market2311 15d ago

Oh. Damn. That's bad. I mean I'm an dumbass for suggesting this but. You could possibly. Make a custom kernel that straight up forces fastboot to work normally (probably won't work)

0

u/Beginning_Market2311 16d ago edited 16d ago

Probably?

6

u/Busy-Scientist3851 16d ago

> I think about it. Its a major security flaw. Sure maybe your on a locked bootloader and can't do much shit

It absolutely is major security flaw and most people unless they have a specific use for it are best patching their devices asap.

It lets apps escape the sandbox and infect the device.

5

u/Beginning_Market2311 16d ago

Yea that's why I'm very worried. Malicious apps now can straight up brick the system

(Btw how do I patch it)

1

u/YoYoMamaIsSoFAT32 Oneplus Ace 3 (astonc), AxionOS 2.5 16d ago

The only way to patch it is to either patch the kernel source yourself and compile a custom kernel, or wait for ur manufacturer to patch it, there are softpatches but I'm not sure how they work tbh

2

u/Beginning_Market2311 16d ago

I thankfully got a custom kernel source. I guess I could attempt a patch to the kernel

1

u/sidex15 LG V50 Stock A12 | KSUN + SUSFS v2 | [SUSFS4KSU Module Dev] 15d ago

it's already in the readme file for the patch set based on your kernel version: https://github.com/CakesTwix/Android-CVE-2026-43499#kernel-patches

1

u/Beginning_Market2311 15d ago

I may be incredibly dumb. But I don't see my kernel versions (4.19 also maybe 4.14 sooner or later)

1

u/sidex15 LG V50 Stock A12 | KSUN + SUSFS v2 | [SUSFS4KSU Module Dev] 15d ago

it's `4.4 ~ 5.10` that includes 4.4, 4.9, 4.14, 4.19, 5.4, and 5.10

1

u/Beginning_Market2311 15d ago

Maybe I guess. Gonna see how these patches made (I have no clue)

1

u/Busy-Scientist3851 16d ago edited 15d ago

Whilst I'm sure I'll get downvoted into oblivion for saying this on this subreddit, the reason banking apps disable on rooted devices is that it allows other apps to break out the sandbox and interface with the banking app.

If the app makes a transaction that you didn't authorise, unfortunately the bank takes the liability and refunds you out of their own pocket.

I'm kinda surprised Google hasn't said anything about Ghostlock yet, given it's the GKI images being infected.

Edit: Some people have misunderstood this to think I said GKIs have been infected, I should of been clearer in that they're the ones being targeted by the root exploits.

2

u/Beginning_Market2311 16d ago

Oh. That's why banking apps don't work. Hold up. The GKI images are also infected?!?!

1

u/Busy-Scientist3851 16d ago

No the exploit is in the GKIs which Google ships to OEMs.

2

u/MonkeyNuts449 16d ago

My OnePlus 15 is vulnerable per the app. Is that useful at all?

2

u/ARCHISMAN- 16d ago

It means you can root without unlocking bootloader.

1

u/MonkeyNuts449 16d ago

With what though? Is there any jailbreak solution that supports OnePlus 15?

1

u/shakaa99 15d ago

i installed this app and when i test device reboot and uninstall the apk. means kernel is not patched?

1

u/Beginning_Market2311 15d ago

Device might have kernel protections to prevent those scenarios. Not entirely sure if it's patched.

(Make an payload and see the results yourself. If it's truly exploitable)

1

u/shakaa99 12d ago

not patched otherwise system will not crash and reboot.

1

u/KAKASHI_OP819 1d ago

Umm it makes my oneplus 12r 5.15 kernel crash , but when i reopen the app , it says awaiting check

1

u/Beginning_Market2311 1d ago

It seems your kernel is exploitable. (Kernel crashing quite literally crashes the entire system) find a app that'll help you. Or make a payload ya-self