Security Advisory

CVE-2017-5624

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2017-03-12 04:57:00

Last updated 2024-08-05 15:04:15

Assigner mitre

CVSS score not scored

State PUBLISHED

Description

An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disable_dm_verity' command. Having dm-verity disabled, the kernel will not verify the system partition (and any other dm-verity protected partition), which may allow for persistent code execution and privilege escalation.

← Browse all CVEs View on cve.org ↗