Executive brief
A security flaw in the OnePlus 3 and 3T smartphones allows an attacker with physical access or a local USB connection to disable critical security protections. By rebooting the device into a specific maintenance mode, an attacker can turn off SELinux, a core defense mechanism that prevents apps from accessing unauthorized data or taking over the system. This compromise persists even after the phone is restarted, making it easier for malicious software to gain deep control over the device without the user's knowledge.
Technical details
The ABOOT bootloader in OnePlus 3 and 3T devices fails to restrict sensitive OEM commands when the bootloader is in a locked state. An attacker can reboot the device into fastboot mode (via physical 'Volume Up' interaction or 'adb reboot bootloader') and execute the 'fastboot oem selinux permissive' command. This vulnerability exists because OnePlus modified the Android 'init' process to honor the 'androidboot.selinux' kernel flag even in production builds, which is typically ignored in standard Android 'user' builds. Successfully executing this command sets SELinux to permissive mode, bypassing Mandatory Access Control (MAC) policies and facilitating privilege escalation. The change is persistent across hard reboots and does not require root privileges to implement. The issue was patched in OxygenOS 4.0.2.
Affected products
- OnePlus OxygenOS Before 4.0.2
- OnePlus OnePlus 3 All versions using OxygenOS before 4.0.2
- OnePlus OnePlus 3T All versions using OxygenOS before 4.0.2
Timeline
- 2017-01-11: disclosed: Initial public disclosure by security researchers
- 2017-01-18: patched: Fixed in OxygenOS 4.0.2
- 2017-01-23: advisory: CVE-2017-5554 assigned and NVD entry published