CVE-2016-2435

Credit: [email protected] (IceSwordLab)

Exploit

Just for Nexus 9 MMB29R, if you want to run on other version, some symbol address should be changed
shell@flounder:/ $ getprop ro.build.fingerprint
google/volantis/flounder:6.0.1/MMB29R/2482564:user/release-keys

EXP

Reference