OnePlus OxygenOS/HydrogenOS updater-script access control

Summaryinfo

A vulnerability was found in OnePlus OxygenOS and HydrogenOS and classified as critical. Impacted is an unknown function of the component updater-script. Such manipulation leads to access control. This vulnerability is traded as CVE-2017-5948. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in OnePlus OxygenOS and HydrogenOS (the affected version is unknown) and classified as critical. Affected by this issue is an unknown code of the component updater-script. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).

The bug was discovered 05/11/2017. The weakness was shared 05/11/2017 (Website). The advisory is shared for download at alephsecurity.com. This vulnerability is handled as CVE-2017-5948 since 02/09/2017. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• OnePlus

Name

• HydrogenOS
• OxygenOS

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion