CVE-2017-5626

OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands 4F500301 and 4F500302 that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code...

CVE-2017-5624

An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the locked bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system...

CVE-2017-5624

CVE-2017-5624 affects OnePlus 3/3T OxygenOS before 4.0.3, where the attacker can bypass dm-verity by issuing fastboot oem disable_dm_verity, causing the kernel to verify no partitions and enabling persistent code execution and privilege escalation. Public writeups describe a chain with CVE-2017-5...

CVE-2017-5626

CVE-2017-5626 affects OnePlus OnePlus 3/3T with OxygenOS before 4.0.2. The vulnerability hinges on two hidden fastboot oem commands (4F500301 and 4F500302) that bypass the bootloader lock, ignore OEM Unlocking, and do not require user confirmation or data erasure. Exploitation was demonstrated by...

CVE-2017-5626

OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands 4F500301 and 4F500302 that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code...

PT-2017-3177

Name of the Vulnerable Software and Affected Versions OxygenOS versions prior to 4.0.3 Description An issue in OxygenOS allows an attacker to persistently disable dm-verity, which is used by the kernel to verify the system partition, by issuing the fastboot oem disable dm verity command. This may...

CVE-2017-5626: Undefined Security Weakness

OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands 4F500301 and 4F500302 that allow the attacker to lock/unlock the bootloader, disregarding the 'OEM Unlocking' checkbox, without user confirmation and without a factory reset. This allows for persistent code...

CVE-2017-5624: Improper Privilege Management

An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the locked bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system...

PT-2017-3176

Name of the Vulnerable Software and Affected Versions OxygenOS versions prior to 4.0.2 Description The issue is related to insufficient access control in OxygenOS, allowing an attacker to exploit hidden fastboot oem commands 4F500301 and 4F500302 to lock or unlock the bootloader without user...

Get a locked OnePlus 3/3T: boot loader vulnerability-vulnerability warning-the black bar safety net

In this article, I disclosed the OnePlus 3/3T boot loader in the two holes. The first CVE-2017-5626 is the impact of OxygenOS 3.2-4.0.1（4.0.2 to patch high-risk vulnerabilities. The vulnerability allows a physical opponent or use ADB/ FASTBOOT access to bypass the bootloader lock state, even if t...

OnePlus 3/3T: Bootloader disable dm-verity Vulnerability (CVE-2017-5624)

CVE-2017-5624, affecting all versions of OxygenOS to date, allows the attacker to disable dm-verity. The combination of the vulnerabilities enables a powerful attack – persistent highly privileged code execution without any warning to the user and with access to the original user’s data after the...

Authentication flaw

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can iss...

CVE-2017-5554

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can iss...

CVE-2017-5554

The CVE covers OnePlus 3/3T devices running OxygenOS before 4.0.2. A physical attacker can boot into fastboot without authentication by pressing Volume Up during boot and using adb reboot bootloader. Once in fastboot, the attacker can issue fastboot oem selinux permissive to set SELinux to Permis...

CVE-2017-5554

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can iss...

CVE-2017-5554: Improper Authentication

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can iss...

PT-2017-16574

Name of the Vulnerable Software and Affected Versions OnePlus 3 and 3T OxygenOS versions prior to 4.0.2 Description An issue was discovered in ABOOT that allows an attacker to reboot the device into fastboot mode without authentication. This can be achieved by either physically pressing the "Volu...

OnePlus OxygenOS Now Available for Download

OnePlus One users might be waiting for the new Lollipop based ROM for their smartphones. The wait is over as the popular Chinese smartphone maker OnePlus has finally released its own custom ROM -- OnePlus OxygenOS, which is based on Android 5.0 Lollipop. Last month, the OnePlus announced the...