CVE-2017-5624
CriticalSummary
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T that allows an attacker to persistently make the (locked) bootloader start with dm-verity disabled. This results in the kernel not verifying the system partition, potentially allowing for persistent code execution and privilege escalation.
Risk Assessment
Disabling dm-verity poses a serious risk to system integrity, enabling attackers to introduce malicious code and gain elevated privileges within the system.
Recommendation
It is recommended to update the system to the latest version of OxygenOS to secure the bootloader and restore dm-verity verification.
Other vulnerabilities in OxygenOS
See all- CVE-2017-5626Critical
OxygenOS before version 4.0.2 on OnePlus 3 and 3T has two hidden fastboot oem commands that allow an attacker to lock/unlock the bootloader without user confirmation. This allows for persistent code execution with high privileges and complete access to user data.
- CVE-2026-70387High
On OnePlus OxygenOS for Android, the olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string; the only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in those domains (including dumpstate, reachable from an unprivileged app) obtains arbitrary command execution, with the spawned shell landing in the u:r:vendor_qti_init_shell:s0 SELinux context holding all Linux capabilities.
Original NVD description (English source)
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disable_dm_verity' command. Having dm-verity disabled, the kernel will not verify the system partition (and any other dm-verity protected partition), which may allow for persistent code execution and privilege escalation.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS