CVE-2026-70387 in OxygenOS
Summary
by MITRE • 10/21/2026
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability described constitutes a critical privilege escalation flaw within the OnePlus OxygenOS operating system on Android devices, specifically affecting versions ranging from 16.1.0 prior to 16.1.10.500, 16.0.0 prior to 16.0.5.1200, and 15.0.0 prior to 15.0.0.2000. The core of the issue lies in the olc2 logging hardware abstraction layer, which exposes a binder method that allows for arbitrary command execution through improper authorization controls. This function operates by forking a new process and invoking execl with the path /vendor/bin/sh to execute shell commands provided directly by the caller. Such an implementation pattern is fundamentally insecure because it grants any entity capable of binding to this service complete control over system-level operations, bypassing standard application sandbox restrictions.
The authorization mechanism employed in this vulnerability relies solely on checking if the calling user identifier equals zero, indicating root privileges. However, this check is insufficiently restrictive due to broader SELinux policy configurations that grant binder access to a wide client attribute. Consequently, any process running with uid-0 within domains associated with this attribute can exploit the flaw. Notably, the dumpstate service falls under these permissions and serves as a critical attack vector because it is reachable from unprivileged applications via other vulnerabilities in the system chain. This means that an attacker starting from a low-privilege app context can leverage existing weaknesses to reach dumpstate, thereby gaining access to this dangerous logging interface without needing direct root privileges initially.
Upon successful exploitation, the spawned shell operates within the u:r:vendor_qti_init_shell:s0 SELinux context. This specific domain is particularly dangerous because it holds all Linux capabilities, effectively granting the attacker full administrative control over the device's kernel and system services. The use of a policy type_transition further solidifies this privilege elevation by automatically assigning high-privilege contexts to processes spawned under certain conditions. This combination allows for arbitrary code execution with root-level permissions, enabling attackers to install persistent malware, exfiltrate sensitive user data, modify system configurations, or compromise the integrity of the entire device ecosystem.
From a classification perspective, this vulnerability aligns closely with CWE-269, which addresses Improper Privilege Management, as well as CWE-78, representing OS Command Injection via improper neutralization of special elements in commands. In terms of tactical mapping within the MITRE ATT&CK framework for mobile platforms, this behavior corresponds to techniques involving privilege escalation and command execution through system services. The exploitation chain demonstrates how multiple smaller vulnerabilities can be chained together to achieve a significant security breach, highlighting the importance of defense-in-depth strategies in Android-based operating systems.
Mitigation efforts must focus on restricting binder access permissions within SELinux policies to ensure that only essential components with verified trust levels can interact with critical hardware abstraction layers like olc2 logging HAL. Developers should implement strict input validation and avoid using shell interpreters for executing dynamic commands, opting instead for safer alternatives such as direct system calls or predefined executable binaries with limited scopes. Additionally, enforcing least-privilege principles across all service domains will prevent unauthorized processes from leveraging high-capability contexts even if they manage to bind to vulnerable interfaces. Users of affected OxygenOS versions should immediately update their devices to the patched releases where these authorization checks have been hardened and unnecessary binder permissions have been revoked for non-critical services.