CVE-2017-5624: Critical severity OnePlus OxygenOS vulnerability
An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform with dm-verity disabled, by issuing the 'fastboot oem disabledmverity' command. Having dm-verity disabled, the kernel will not verify the system partition (and any other dm-verity protected partition), which may allow for persistent code execution and privilege escalation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5624?
CVE-2017-5624 has a high severity rating because it allows attackers to disable dm-verity, compromising system integrity.
How do I fix CVE-2017-5624?
To fix CVE-2017-5624, update your OxygenOS to version 4.0.3 or later, as this issue is addressed in the update.
What devices are affected by CVE-2017-5624?
CVE-2017-5624 affects OnePlus 3 and 3T devices running OxygenOS versions up to 4.0.2.
What does dm-verity do in relation to CVE-2017-5624?
In the context of CVE-2017-5624, dm-verity is responsible for verifying the integrity of the system partition, and disabling it allows unauthorized modifications.
Can CVE-2017-5624 lead to data loss or unauthorized access?
Yes, CVE-2017-5624 can potentially lead to data loss or unauthorized access as it allows the bootloader to load an unverified system image.