Breaking the Android Bootloader on the Qualcomm Snapdragon 660

This post is a companion to the DEF CON 29 video available here. A few months ago I purchased an Android phone to do some research around a specific series of NFC chips, which required me to gain root access to the device in order to fully access its hardware capabilities. Gaining root access on...

kexec-tools bug fix and enhancement update

The kexec-tools packages contain the /sbin/kexec binary and utilities that together form the user-space component of the kernel's kexec feature. The /sbin/kexec binary facilitates a new kernel to boot using the kernel's kexec feature either on a normal or a panic reboot. The kexec fastboot...

Google Android Fastboot Information Disclosure Vulnerability

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA, of which Fastboot is a fastboot component. An information disclosure vulnerability exists in Fastboot in Android. An attacker can exploit this vulnerability to obtain information...

CVE-2018-11943

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing fastboot flash command, memory leak or unexpected behavior may occur due to processing of unintialized data buffers...

Command injection

In all android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the linux kernel, while processing fastboot flash command, memory leak or unexpected behavior may occur due to processing of unintialized data buffers...

CVE-2018-11259

Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and...

CVE-2018-11259

This CVE (CVE-2018-11259) concerns Qualcomm Snapdragon devices (Automobile, Mobile, Wear) with NAND-based EFS storage. Root cause: improper access control allows fastboot access to erase the EFS partition, after which the apps processor has non-secure world read/write access to that partition unt...

CVE-2018-11259

Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and...

CVE-2018-11259

Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and...

Stack overflow

A stack-based buffer overflow can occur in fastboot from all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel...

CVE-2018-5854

A stack-based buffer overflow can occur in fastboot from all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel...

CVE-2018-5854

CVE-2018-5854 is a stack-based buffer overflow affecting the Qualcomm bootloader used in CAF/Linux-based Android deployments (fastboot). The vulnerability is classified as an Elevation of Privilege (EoP) issue with High/Critical impact, occurring in the bootloader component and enabling local pri...

OnePlus 6 Flaw Allows to Boot Any Image Even With Locked Bootloader

Have you recently bought a OnePlus 6? Don't leave your phone unattended. A serious vulnerability has been discovered in the OnePlus 6 bootloader that makes it possible for someone to boot arbitrary or modified images to take full admin control of your phone—even if the bootloader is locked. A...

CVE-2018-5854

A stack-based buffer overflow can occur in fastboot from all Android releasesAndroid for MSM, Firefox OS for MSM, QRD Android from CAF using the Linux kernel...

The vulnerability of the OxygenOS operating system in OnePlus 3 and 3T devices allows attackers to gain elevated privileges and expose sensitive information.

The vulnerability of the OxygenOS operating system in OnePlus 3 and 3T devices is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain root privileges and disclose sensitive information by replacing the device’s system...

The vulnerability of the OxygenOS operating system on OnePlus 3 and 3T devices, which allows a hacker to gain increased privileges

The vulnerability of the OxygenOS operating system in OnePlus 3 and 3T devices is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to gain root privileges and block notifications regarding the replacement of the system partition by using the...

Google Android Fastboot Qualcomm Component Elevation of Privilege Vulnerability

Android is a free and open source Linux-based operating system led and developed by Google Inc. and the Open Handset Alliance. An elevation of privilege vulnerability exists in the Google Android Fastboot Qualcomm component. An attacker can exploit this vulnerability to achieve elevation of...

CVE-2017-2691

Huawei P9 versions earlier before EVA-AL10C00B373, versions earlier before EVA-CL00C92B373, versions earlier before EVA-DL00C17B373, versions earlier before EVA-TL00C01B373 have a lock-screen bypass vulnerability. An unauthenticated attacker could force the phone to the fastboot mode and delete t...

CVE-2017-2691

Huawei P9 versions earlier before EVA-AL10C00B373, versions earlier before EVA-CL00C92B373, versions earlier before EVA-DL00C17B373, versions earlier before EVA-TL00C01B373 have a lock-screen bypass vulnerability. An unauthenticated attacker could force the phone to the fastboot mode and delete t...

CVE-2017-2691

Huawei P9 versions earlier before EVA-AL10C00B373, versions earlier before EVA-CL00C92B373, versions earlier before EVA-DL00C17B373, versions earlier before EVA-TL00C01B373 have a lock-screen bypass vulnerability. An unauthenticated attacker could force the phone to the fastboot mode and delete t...