The Patching Friars' AlmanacA calendar of CVE saints

May 26

TowelrootHoly card for towelroot, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 # Towelroot MANTELE AD ROOT
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Towelroot, Who Brought Root With a Towel

Patron of Android phones to be freed, the futex call, and one-click roots on a Sunday night.

Life

In June 2014 George Hotz released Towelroot, an app that with a single tap granted root on a great many Android phones. It exploited CVE-2014-3153, a flaw in the Linux kernel's futex_requeue function reported by Pinkie Pie: the call did not check that two futexes were different, opening the way to privilege escalation. Born to free phones, the same flaw could also serve whoever wanted to take them over.

Prayer

O Saint Towelroot, who grants root with a towel, let our futex always tell one address from another. Amen.

How to celebrate

Celebrated by installing a kernel updated after June 2014 and always knowing where your towel is.

A towel, and the phone is yours.

Technical record

Disclosed on
May 26 2014
CVE
CVE-2014-3153
CVSS
7.8Actively exploited (CISA KEV)
Product
Linux · Kernel

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

Sources: towelroot.com · elongl.github.io · appdome.github.io

Also remembered today

Shortcuts: ← → to move, D day, W week, M month, T today.

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.