CVE-2017-8850: Medium severity oxygenos vulnerability
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. Due to a lenient updater-script in the OnePlus OTA images, and the fact that both ROMs use the same OTA verification keys, attackers can install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders, which allows for exploitation of vulnerabilities patched on one image but not on the other, in addition to expansion of the attack surface. This vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, physical attackers can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8850?
CVE-2017-8850 has a medium severity level due to its risk of unauthorized system installations.
How does CVE-2017-8850 affect OnePlus devices?
CVE-2017-8850 allows attackers to install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders.
What devices are impacted by CVE-2017-8850?
CVE-2017-8850 affects OnePlus One, X, 2, 3, and 3T devices.
How can I mitigate the issues caused by CVE-2017-8850?
To mitigate CVE-2017-8850, avoid using OTA updates from untrusted sources and consider unlocking your bootloader.
Is there a patch available for CVE-2017-8850?
As of now, a specific patch for CVE-2017-8850 has not been widely publicized.