OxygenOS vulnerabilities

OxygenOS before version 4.0.2 on OnePlus 3 and 3T has two hidden fastboot oem commands that allow an attacker to lock/unlock the bootloader without user confirmation. This allows for persistent code execution with high privileges and complete access to user data.

An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T that allows an attacker to persistently make the (locked) bootloader start with dm-verity disabled. This results in the kernel not verifying the system partition, potentially allowing for persistent code execution and privilege escalation.

On OnePlus OxygenOS for Android, the olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string; the only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in those domains (including dumpstate, reachable from an unprivileged app) obtains arbitrary command execution, with the spawned shell landing in the u:r:vendor_qti_init_shell:s0 SELinux context holding all Linux capabilities.