Unpatched OnePlus flaws let installed apps gain root access
Summary
A researcher chained two OnePlus software flaws to let an installed, no-permission app gain root on affected phones. OnePlus had released no fix by disclosure; there was no evidence of real-world exploitation.
Key points
- The attack chains flaws in OnePlus’s AtlasService and olc2 services to escalate an installed app to root-level control.
- A malicious app must already be installed and running; the attack cannot be launched over the internet and requires no special app permissions.
- The researcher demonstrated the flaws on a OnePlus 15 and OnePlus 12 Pro. OnePlus said some other OnePlus and OPPO devices may also be affected, without naming them.
- OnePlus had confirmed the flaws in May, but no fix, CVE, or official advisory was available when the researcher disclosed them on September 24.
- There was no evidence that the flaws had been used in real-world attacks.
- Until a fix is released, the article advises installing apps only from trusted sources.
Article Details
- Vulnerability Types
- Improper caller authorization in AtlasService
- Unchecked input passed to a system command
- Unauthenticated shell-command execution by olc2 for callers already running as root
- Affected Versions
- OnePlus 15
- OnePlus 12 Pro
- OxygenOS 16
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- unavailable
- Workarounds
- Install apps only from sources you trust.
MITRE ATT&CK
People
Vendors
OnePlusA researcher chained two flaws in OnePlus software to let a no-permission malicious app gain root on a OnePlus 15 and other affected devices.OPPOOnePlus said the issues also affect some OPPO devices, but had not released a fix before the disclosure and no evidence of real-world exploitation has been found.