CVE-2026-70387: OnePlus OxygenOS exposed dangerous method vulnerability
Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl("/vendor/bin/sh", "sh", "-c", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendorqtiinitshell:s0 SELinux context via a policy typetransition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.
Affected Software
Event History
Frequently Asked Questions
Which OxygenOS versions are affected?
Affected versions are 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000.
What access does an attacker need to exploit this issue?
The vulnerable binder method only accepts callers whose UID is 0. However, SELinux policy permits a broad set of client domains to access the logging HAL, and the described related vulnerability can make the dumpstate domain reachable from an unprivileged app.
What is the impact after successful exploitation?
A successful caller can supply an arbitrary shell command to a process that executes it through /vendor/bin/sh. The resulting shell transitions into the vendor_qti_init_shell SELinux domain, which has all Linux capabilities.