CVE-2017-5948: Input Validation
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5948?
CVE-2017-5948 is considered to have a medium severity level due to the potential for downgrade attacks.
How do I fix CVE-2017-5948?
To fix CVE-2017-5948, ensure that you are using the latest version of OxygenOS or HydrogenOS that has patched the downgrade vulnerability.
Which devices are affected by CVE-2017-5948?
CVE-2017-5948 affects OnePlus One, X, 2, 3, and 3T devices using OxygenOS and HydrogenOS.
What type of attack does CVE-2017-5948 describe?
CVE-2017-5948 describes a downgrade attack that allows attackers to force a device to install an older, potentially vulnerable firmware version.
Why is the 'updater-script' problematic in CVE-2017-5948?
The 'updater-script' in CVE-2017-5948 is problematic because it does not verify that the current firmware version is lower than or equal to the version being installed.