OnePlus X and One Devices CVE-2017-8851 Security Bypass Vulnerability

Bugtraq ID:	98501
Class:	Design Error
CVE:	CVE-2017-8851
Remote:	Yes
Local:	No
Published:	May 11 2017 12:00AM
Updated:	May 11 2017 12:00AM
Credit:	Roee Hay of Aleph Research, HCL Technologies
Vulnerable:	OnePlus X 0 OnePlus OxygenOS 4.1.3 OnePlus OxygenOS 4.1.1 OnePlus OxygenOS 4.1 OnePlus OxygenOS 4.0.3 OnePlus OxygenOS 4.0.2 OnePlus OxygenOS 4.0.1 OnePlus One 0 OnePlus HydrogenOS 3.0
Not Vulnerable:

OnePlus X and One Devices CVE-2017-8851 Security Bypass Vulnerability

OnePlus X and One devices are prone to a security-bypass vulnerability.

Successfully exploiting this issue may allow attackers to bypass certain security restrictions and perform unauthorized actions by conducting a man-in-the-middle attack. This may lead to other attacks.

The following versions are affected:

OnePlus X running OxygenOS 4.1.3 and prior or HydrogenOS 3.0 and prior.
OnePlus One running OxygenOS 4.1.3 and prior or HydrogenOS 3.0 and prior.

OnePlus X and One Devices CVE-2017-8851 Security Bypass Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

OnePlus X and One Devices CVE-2017-8851 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

OnePlus X and One Devices CVE-2017-8851 Security Bypass Vulnerability

References:

• OnePlus Homepage (OnePlus)
  
• OnePlus OTAs: Analysis & Exploitation (Alephsecurity)
  
• OnePlus OTA One/X Crossover Vulnerability (alephsecurity)