[AT&T Samsung Galaxy Note 4] FiniteTime:
Thanks for looking into and trying to exploit CVE-2014-8609. From a search on xda I see comments by users Genesis730, Orito and ZPaul2Fresh8 that might be helpful/relevant (from this search):

http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post57802929#post57802929

http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post57946884#post57946884

http://xdaforums.com/note-4-att/gen...t-progress-t2961974/post57821235#post57821235

In that second link ZPaul2Fresh8 says "As for the CVE-2014-8609, that wouldn't work as it's at user level and I cannot see this at system level to gain privileges we want. " Though Orito seems unsure. Confirming if we can use an existing CVE, like CVE-2014-8609, or if we have to find a new exploit would be good to know.

EDIT:

Here's a quick link to a Google Translate of that blog post: https://translate.google.com/transl...hp/2014/11/14/broadAnywhere-bug-17356824.html

EDIT 2:

CVE-2014-8609 is also known as Android bug 17356824 (link) and the vulnerability is nicknamed "BroadAnywhere".

From the second quote I wonder, is broadcasting an intent with the same permissions and identity of the Settings application which runs as SYSTEM uid enough to gain root?

The third quote from the Google Translated broadAnywhere-bug-17356824 blog post lists some examples of what the exploit could do, but none look like gaining root to me. Thoughts?

EDIT 3:

Orito's post here: http://xdaforums.com/showpost.php?p=57802929&postcount=279 is really an incredible post. Suggests using CVE-2014-8609 with CVE-2014-7911 which just might work. Anyone working on root should read it.

EDIT 5:

Some posts on CVE-2014-7911

http://xdaforums.com/z3-compact/gen...der-method-t2940539/post57101410#post57101410

http://xdaforums.com/z3-compact/gen...der-method-t2940539/post57849613#post57849613

http://xdaforums.com/z3-compact/gen...der-method-t2940539/post57849859#post57849859

http://xdaforums.com/z3-compact/gen...der-method-t2940539/post57854724#post57854724

http://xdaforums.com/droid-turbo/ge...root-turbo-t2927958/post56880853#post56880853

http://xdaforums.com/droid-turbo/ge...root-turbo-t2927958/post56884517#post56884517

http://xdaforums.com/fire-tv/genera...ces-recent-t2918058/post56905336#post56905336

http://xdaforums.com/fire-tv/genera...ces-recent-t2918058/post56905929#post56905929

From: https://www.google.com/search?q="seclists.org/fulldisclosure/2014/Nov/51"+site:xdaforums.com

http://xdaforums.com/kindle-fire-hd...ure-bypass-t2964142/post57654764#post57654764

From: https://www.google.com/search?q=CVE-2014-7911+site:xdaforums.com

Also general searches:

https://www.google.com/search?q="seclists.org/fulldisclosure/2014/Nov/51"

https://www.google.com/search?q=CVE-2014-7911

EDIT 6:

CVE-2014-7911: Android <5.0 Privilege Escalation using ObjectInputStream

http://seclists.org/fulldisclosure/2014/Nov/51

Reading that email makes me wonder if CVE-2014-7911 might just work on its own, but CVE-2014-8609 might make CVE-2014-7911 easier to use (not sure if CVE-2014-8609 with privileged intents helps with that or not).

If you can insert data into a process at a known address using CVE-2014-7911, possibly with CVE-2014-8609, then there needs to be an app that lets one gain root (say that isn't locked down).

Someone experienced enough to implement arbitrary code execution using CVE-2014-7911 (possibly using CVE-2014-8609) might want to investigate the AT&T Note 4's software specifically to see what, if anything, could be used to gain root.