<commit_before>---
layout: post
title: 'Owning a Locked OnePlus 3/3T: Bootloader Vulnerabilities'
author: <NAME>
date: '2017-02-08'
tags: OnePlus3 OnePlus3T Vulnerability Bootloader 4F500301 4F500302 dm-verity disable_dm_verity Unlock Bypass 
description: '2 vulnerabilities in OnePlus 3/3T bootloader. CVE-2017-5626: Bypassing its lock state (fastboot oem 4F500301). CVE-2017-5624: Disabling dm-verity (fastboot oem disable_dm_verity).'
---

In this blog post I disclose two vulnerabilities in the OnePlus 3/3T bootloader. The first one, [CVE-2017-5626], is a critical severity vulnerability affecting OxygenOS 3.2-4.0.1 (4.0.2 is patched). The vulnerability allows for a physical adversary (or one with ADB/fastboot access) to bypass the bootloader's lock state, even when `Allow OEM Unlocking` is disabled, without user confirmation and without triggering a factory reset. This vulnerability allows for kernel code execution (albeit with a [5 seconds warning](#exploiting-cve-2017-5626-for-kernel-code-execution) upon boot). The second vulnerability, [CVE-2017-5624], affecting all versions of OxygenOS to date, allows the attacker to disable `dm-verity`. The combination of the vulnerabilities enables a powerful attack -- persistent highly privileged code execution without any warning to the user and with access to the original user's data (after the victim enters his credentials).


Both issues were responsibly disclosed to and acknowledged by *OnePlus Security*. The first vulnerability, [CVE-2017-5626], was reported on **January 23rd**. It was also found independently by a OnePlus engineer. [CVE-2017-5624], reported on **January 16th**, should be fixed in a future OxygenOS release -- the reason for its today's public disclosure is because someone already [published](https://forum.xda-developers.com/oneplus-3/how-to/fix-easy-method-removing-dm-verity-t3544339) it on **January 24th**.

*Disclaimer*: I tested the vulnerabilities on OnePlus 3 only, but OnePlus 3T contains the vulnerable code too.

### Bypassing the Bootloader's Lock (CVE-2017-5626) ###
OnePlus 3 & 3T running OxygenOS 3.2 - 4.0.1 had two proprietary fastboot `oem` commands:

1. `fastboot oem 4F500301` -- bypasses the bootloader's lock -- allowing one with fastboot access to effectively unlock the device, disregarding `OEM Unlocking`, without user confirmation and without erasure of userdata (which normally occurs after lock-state changes). Moreover, the device still reports it's locked after running this command.

2. `fastboot oem 4F500302` -- resets various bootloader settings. For example, it will lock an unlocked bootloader without user confirmation.

Analyzing the bootloader binary shows that the routine which handles the `4F500301` command is pretty straightforward: 

```c
// 'oem 4F500301' handler
int sub_918427F0()
{
  magicFlag_dword_91989C10 = 1;
  if ( dword_9198D804 != dword_9198D804 )<commit_msg>4.0.3 patch update<commit_after>---
layout: post
title: 'Owning a Locked OnePlus 3/3T: Bootloader Vulnerabilities'
author: <NAME>
date: '2017-02-08'
tags: OnePlus3 OnePlus3T Vulnerability Bootloader 4F500301 4F500302 dm-verity disable_dm_verity Unlock Bypass 
description: '2 vulnerabilities in OnePlus 3/3T bootloader. CVE-2017-5626: Bypassing its lock state (fastboot oem 4F500301). CVE-2017-5624: Disabling dm-verity (fastboot oem disable_dm_verity).'
---

In this blog post I disclose two vulnerabilities in the OnePlus 3/3T bootloader. The first one, [CVE-2017-5626], is a critical severity vulnerability affecting OxygenOS 3.2-4.0.1 (4.0.2 is patched). The vulnerability allows for a physical adversary (or one with ADB/fastboot access) to bypass the bootloader's lock state, even when `Allow OEM Unlocking` is disabled, without user confirmation and without triggering a factory reset. This vulnerability allows for kernel code execution (albeit with a [5 seconds warning](#exploiting-cve-2017-5626-for-kernel-code-execution) upon boot). The second vulnerability, [CVE-2017-5624], affecting all versions of OxygenOS to date (**Feb 10 UPDATE: OxygenOS 4.0.3 seems to be patched**), allows the attacker to disable `dm-verity`. The combination of the vulnerabilities enables a powerful attack -- persistent highly privileged code execution without any warning to the user and with access to the original user's data (after the victim enters his credentials).


Both issues were responsibly disclosed to and acknowledged by *OnePlus Security*. The first vulnerability, [CVE-2017-5626], was reported on **January 23rd**. It was also found independently by a OnePlus engineer. [CVE-2017-5624], reported on **January 16th**, should be fixed in a future OxygenOS release -- the reason for its today's public disclosure is because someone already [published](https://forum.xda-developers.com/oneplus-3/how-to/fix-easy-method-removing-dm-verity-t3544339) it on **January 24th**.

*Disclaimer*: I tested the vulnerabilities on OnePlus 3 only, but OnePlus 3T contains the vulnerable code too.

### Bypassing the Bootloader's Lock (CVE-2017-5626) ###
OnePlus 3 & 3T running OxygenOS 3.2 - 4.0.1 had two proprietary fastboot `oem` commands:

1. `fastboot oem 4F500301` -- bypasses the bootloader's lock -- allowing one with fastboot access to effectively unlock the device, disregarding `OEM Unlocking`, without user confirmation and without erasure of userdata (which normally occurs after lock-state changes). Moreover, the device still reports it's locked after running this command.

2. `fastboot oem 4F500302` -- resets various bootloader settings. For example, it will lock an unlocked bootloader without user confirmation.

Analyzing the bootloader binary shows that the routine which handles the `4F500301` command is pretty straightforward: 

```c
// 'oem 4F500301' handler
int sub_918427F0()
{
  magicFlag_dword_91989C10 = 1;
  if ( dword_9198D804 != dword_9198D804 )
{'fraction_non_alphanumeric': 0.07841469637693485, 'fraction_numerical': 0.0670182003742133, 'mean_word_length': 4.963488843813387, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 5, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7478507', 'n_tokens_mistral': 1956, 'n_tokens_neox': 1632, 'n_words': 731}