An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
References
| Link | Resource |
|---|---|
| https://alephsecurity.com/vulns/aleph-2017008 | Exploit Technical Description Third Party Advisory |
| https://alephsecurity.com/vulns/aleph-2017008 | Exploit Technical Description Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 03:28
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://alephsecurity.com/vulns/aleph-2017008 - Exploit, Technical Description, Third Party Advisory |
Information
Published : 2017-05-11 18:29
Updated : 2024-11-21 03:28
NVD link : CVE-2017-5948
Mitre link : CVE-2017-5948
CVE.ORG link : CVE-2017-5948
JSON object : View
Products Affected
oneplus
- oneplus_2
- oneplus_x
- oneplus_one
- oxygenos
- oneplus_3
- oneplus_3t
CWE
CWE-20
Improper Input Validation