Bootloader Vulnerability in OnePlus Devices with OxygenOS
CVE-2017-5624

9.8CRITICAL

Key Information:

Vendor

Oneplus

Status
Oxygenos
Vendor
CVE Published:
12 March 2017

What is CVE-2017-5624?

A vulnerability exists in OxygenOS prior to version 4.0.3 affecting OnePlus 3 and 3T devices. By using the 'fastboot oem disable_dm_verity' command, an attacker can disable dm-verity on a locked bootloader. This allows the kernel to bypass verification of the system partition, creating a risk for persistent code execution and privilege escalation, undermining the device's security framework.

References

https://securityresear.ch/2017/02/08/oneplus3-bootloader-...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.