CVE-2016-10225

The sunxi-debug driver in Allwinner 3.4 legacy kernel for H3, A83T and H8 devices allows local users to gain root privileges by sending "rootmydevice" to /proc/sunxi_debug/sunxi_debug.

• CWE-264

• http://www.openwall.com/lists/oss-security/2016/10/05/16Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/02/15/9Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/93442Third Party Advisory, VDB Entry
• https://forum.armbian.com/index.php?/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/Mailing List, Third Party Advisory
• https://irclog.whitequark.org/linux-sunxi/2016-04-29#16314390Issue Tracking, Third Party Advisory
• https://www.rapid7.com/db/modules/exploit/multi/local/allwinner_backdoorExploit, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2016/10/05/16Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2017/02/15/9Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/93442Third Party Advisory, VDB Entry
• https://forum.armbian.com/index.php?/topic/1108-security-alert-for-allwinner-sun8i-h3a83th8/Mailing List, Third Party Advisory
• https://irclog.whitequark.org/linux-sunxi/2016-04-29#16314390Issue Tracking, Third Party Advisory
• https://www.rapid7.com/db/modules/exploit/multi/local/allwinner_backdoorExploit, Third Party Advisory

Published

Mar 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1022Adobe Flash Player before 18.0.0.343 and 19.x through 21.x b…8.8
• CVE-2016-10220The gs_makewordimagedevice function in base/gsdevmem.c in Ar…
• CVE-2016-10221The count_entries function in pdf-layer.c in Artifex Softwar…4.3
• CVE-2016-10222runtime/JSONObject.cpp in JavaScriptCore in WebKit, as distr…
• CVE-2016-10223An issue was discovered in BigTree CMS before 4.2.15. The vu…
• CVE-2016-10224An issue was discovered in Sauter NovaWeb web HMI. The appli…7.2
• CVE-2016-10226JavaScriptCore in WebKit, as distributed in Safari Technolog…
• CVE-2016-10227Zyxel USG50 Security Appliance and NWA3560-N Access Point al…
• CVE-2016-10228The iconv program in the GNU C Library (aka glibc or libc6) …
• CVE-2016-10229udp.c in the Linux kernel before 4.5 allows remote attackers…9.8
• CVE-2016-1023Adobe Flash Player before 18.0.0.343 and 19.x through 21.x b…8.8
• CVE-2016-10230A remote code execution vulnerability in the Qualcomm crypto…