CVE-2017-5554: High severity OnePlus OxygenOS vulnerability
An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2. The attacker can reboot the device into the fastboot mode, which could be done without any authentication. A physical attacker can press the "Volume Up" button during device boot, where an attacker with ADB access can issue the adb reboot bootloader command. Then, the attacker can put the platform's SELinux in permissive mode, which severely weakens it, by issuing: fastboot oem selinux permissive.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OnePlus 3 and 3T OxygenOS (ABOOT)to a version that resolves this vulnerability.Fixed in 4.0.2 - Configuration
Prevent/disable the ability to run the fastboot command 'fastboot oem selinux permissive' so SELinux cannot be switched to permissive mode via unauthenticated fastboot/bootloader access.
Android bootloader (fastboot/ABOOT) SELinux enforcement = enforcing (avoid permissive) - Compensating control
Use a physical security measure or otherwise prevent unauthorized physical access to the device during boot to stop attackers from triggering the Volume Up button path and obtaining ADB access.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5554?
CVE-2017-5554 is classified as a high severity vulnerability due to the potential for unauthorized access to device settings.
How do I fix CVE-2017-5554?
To fix CVE-2017-5554, users should update their OnePlus 3 or 3T devices to OxygenOS version 4.0.2 or later.
Who is affected by CVE-2017-5554?
CVE-2017-5554 affects OnePlus 3 and OnePlus 3T devices running OxygenOS versions prior to 4.0.2.
What impact does CVE-2017-5554 have on devices?
The impact of CVE-2017-5554 allows an attacker to reboot the device into fastboot mode without authentication, potentially compromising the device.
Is ADB access required to exploit CVE-2017-5554?
No, CVE-2017-5554 can be exploited by physically pressing the Volume Up button during boot, making ADB access unnecessary.