# CVE-2017-5554: OnePlus OxygenOS SELinux enforcement bypass in ABOOT

Source: https://junglewise.ai/threats/cve-2017-5554-oneplus-oxygenos-selinux-enforcement-bypass-in-aboot  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-23. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-5554 · Severity: high · CVSS 8.1 · Published 2017-01-23

A security flaw in the OnePlus 3 and 3T smartphones allows an attacker with physical access or a local USB connection to disable critical security protections. By rebooting the device into a specific maintenance mode, an attacker can turn off SELinux, a core defense mechanism that prevents apps from accessing unauthorized data or taking over the system. This compromise persists even after the phone is restarted, making it easier for malicious software to gain deep control over the device without the user's knowledge.

Technologies: [Oneplus Oxygenos](https://junglewise.ai/threats/technologies/oxygenos). Vendors: [Oneplus](https://junglewise.ai/threats/vendors/oneplus).

## Quick answers

**Is CVE-2017-5554 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-5554 being exploited in the wild.

**How severe is CVE-2017-5554?** High severity, with a CVSS score of 8.1, published 23 January 2017.

**Which products and versions are affected?** Oneplus 3 All versions using OxygenOS before 4.0.2; Oneplus 3T All versions using OxygenOS before 4.0.2; Oneplus Oxygenos Before 4.0.2.

**Is there a fix for CVE-2017-5554?** A patch was published on 2017-01-18: Fixed in OxygenOS 4.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2017-5554 attacked?** It is attacked with local access or with physical access, in an operating system.

**Am I affected by CVE-2017-5554?** Check whether you run Oneplus 3, Oneplus 3T or Oneplus Oxygenos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ABOOT bootloader in OnePlus 3 and 3T devices fails to restrict sensitive OEM commands when the bootloader is in a locked state. An attacker can reboot the device into fastboot mode (via physical 'Volume Up' interaction or 'adb reboot bootloader') and execute the 'fastboot oem selinux permissive' command. This vulnerability exists because OnePlus modified the Android 'init' process to honor the 'androidboot.selinux' kernel flag even in production builds, which is typically ignored in standard Android 'user' builds. Successfully executing this command sets SELinux to permissive mode, bypassing Mandatory Access Control (MAC) policies and facilitating privilege escalation. The change is persistent across hard reboots and does not require root privileges to implement. The issue was patched in OxygenOS 4.0.2.

## Affected products

- OnePlus OxygenOS Before 4.0.2
- OnePlus OnePlus 3 All versions using OxygenOS before 4.0.2
- OnePlus OnePlus 3T All versions using OxygenOS before 4.0.2

## Timeline

- 2017-01-11: disclosed: Initial public disclosure by security researchers
- 2017-01-18: patched: Fixed in OxygenOS 4.0.2
- 2017-01-23: advisory: CVE-2017-5554 assigned and NVD entry published

## References

- [http://www.securityfocus.com/bid/95706](http://www.securityfocus.com/bid/95706)
- [https://securityresear.ch/2017/01/11/fastboot-oem-selinux-permissive/](https://securityresear.ch/2017/01/11/fastboot-oem-selinux-permissive/)
- [https://www.xda-developers.com/oneplus-33t-bootloader-vulnerability-allows-changing-of-selinux-to-permissive-mode-in-fastboot/](https://www.xda-developers.com/oneplus-33t-bootloader-vulnerability-allows-changing-of-selinux-to-permissive-mode-in-fastboot/)

## Related threats

- [OnePlus OxygenOS arbitrary command execution in olc2 logging HAL](https://junglewise.ai/threats/cve-2026-70387-exposed-dangerous-method-or-function-and-incorrect-authorization)
- [OnePlus OxygenOS privilege escalation via atlasservice and audio debug service](https://junglewise.ai/threats/cve-2026-70386-improper-neutralization-of-special-elements-used-in-an-os-command)