CVE-2017-5624

Critical

Published: 12/03/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T that allows an attacker to persistently make the (locked) bootloader start with dm-verity disabled. This results in the kernel not verifying the system partition, potentially allowing for persistent code execution and privilege escalation.

Risk Assessment

Disabling dm-verity poses a serious risk to system integrity, enabling attackers to introduce malicious code and gain elevated privileges within the system.

Recommendation

It is recommended to update the system to the latest version of OxygenOS to secure the bootloader and restore dm-verity verification.

Original NVD description (English source)

An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disable_dm_verity' command. Having dm-verity disabled, the kernel will not verify the system partition (and any other dm-verity protected partition), which may allow for persistent code execution and privilege escalation.