CVE-2017-11105
CriticalSummary
The vulnerability in the OnePlus 2 Primary Bootloader (PBL) is due to the lack of validation of the SBL1 partition before execution, even though it contains a certificate. This allows attackers with write access to that partition to disable signature validation.
Risk Assessment
The organization may be exposed to attacks that allow the execution of malicious software by manipulating the SBL1 partition. This could lead to a takeover of the device.
Recommendation
It is recommended to secure access to the SBL1 partition and implement additional signature validation mechanisms in the bootloader.
Original NVD description (English source)
The OnePlus 2 Primary Bootloader (PBL) does not validate the SBL1 partition before executing it, although it contains a certificate. This allows attackers with write access to that partition to disable signature validation.