## https://sploitus.com/exploit?id=B5003184-AAC8-57B0-994B-BA78D431B676
# SELinux-Permissive-Only-version-of-Cheese-aka-CVE-2025-21479
This is an SELinux permissive only version, for now, of the Cheese exploit also known as CVE-2025-21479 which affected the adreno kgsl on many devices including Samsung snapdragon devices
---
### Some of the code has been recycled from the following repos and I would like to thank zhuowei for originally getting the proof of concept off the ground and sarabpal-dev for keeping a well maintained and active repository
[https://github.com/zhuowei/cheese](url)
[https://github.com/sarabpal-dev/cheese-cake](url)
---
### I decided to take on this project as a bit of a challenge and because I've never got into anything this complex before so it was a good learning experience even though it's not done yet. What I originally wanted to do was see if the whole chain could be done from a truly untrusted domain directly in the termux environment. I've managed to achieve SELinux permissive so far without the use of adb, shrunk the code to about a quarter of the original size, it's stable and usually takes less than a minute from start to finish and it's on my Samsung SM-S901W S22 Snapdragon with locked bootloader. I just haven't dug into the root primitive yet and I'm not sure if that could be done without adb, but I'm still going to try. I hope this inspires people to try to do things that typically people say can't be done, maybe someone will have an idea that will work. Feel free to open an issue as I'm open to any helpful contribution.
---
# **TUTORIAL**
This exploit is really easy and theres barely any editing to the code you would need to do in order to get it running on your device. All you need to do is:
- git clone the repo and cd to it
- grab the boot.img from your *exact* firmware
- use unpack_bootimg (it's already in termux) to extract your kernel out of it
- compile the extract-kallsyms.c binary and run it on your kernel
- take your kallsyms.txt and place it directly in the path you're going to be executing the exploit from
- compile with `cc -o gpu_sam gpu_sam.c -ldl`
- it will dynamically go through your kallsyms.txt while it's running to find all the necessary offsets
- the only things you'll have to change depending on your device are the following values for the kernel base scan `const uint64_t candidates[] = { 0xC0000000, 0xE0000000 };` and `for (uint64_t addr = 0xa8000000; addr < 0xa8500000; addr += 0x8000) {`
- if all goes well you should have stable selinux permissive from a regular termux shell
### NOTES
**There will always be a risk of an smmu fault or kernel panic but this works very nicely on my phone with kernel 5.10.168 and rarely do I get a crash. You might have to run it a couple times or even reboot to reset the GPU state. I made this to be as user friendly as possible. The video below is just a quick demo, I already was permissive. Enjoy**
https://github.com/user-attachments/assets/63d0dfa7-1390-41ce-96da-9c34d8a220ec