漏洞标题
N/A
漏洞描述信息
在OnePlus One、X、2、3和3T设备上发现了一个问题。OxygenOS和HydrogenOS容易受到升级降频攻击。这是因为OTA中的“升级脚本”过于宽松，没有检查当前版本是否低于或等于给定图片的版本。升级即使在锁定bootloader的情况下也能发生，而不触发 factory reset，允许攻击者利用已 patches 的漏洞访问用户数据。这种漏洞可以被中间人攻击者利用。这是因为升级交易不会在 TLS(CVE-2016-10370)上发生。此外，物理攻击者可以重启手机进入恢复模式，然后使用“adb sideload”将OTA推送(在OnePlus 3/3T中“Secure Start-up”必须关闭)。
CVSS信息
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
漏洞类别
N/A
漏洞标题
N/A
漏洞描述信息
An issue was discovered on OnePlus One, X, 2, 3, and 3T devices. OxygenOS and HydrogenOS are vulnerable to downgrade attacks. This is due to a lenient 'updater-script' in OTAs that does not check that the current version is lower than or equal to the given image's. Downgrades can occur even on locked bootloaders and without triggering a factory reset, allowing for exploitation of now-patched vulnerabilities with access to user data. This vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process. This is possible because the update transaction does not occur over TLS (CVE-2016-10370). In addition, a physical attacker can reboot the phone into recovery, and then use 'adb sideload' to push the OTA (on OnePlus 3/3T 'Secure Start-up' must be off).
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
多款OnePlus产品OxygenOS和HydrogenOS OTAs 安全漏洞
漏洞描述信息
OnePlus One等都是中国一加科技（OnePlus）公司的智能手机。OxygenOS和HydrogenOS都是其自带的操作系统。HydrogenOS OTAs是HydrogenOS中的一个系统更新应用程序。 多款OnePlus产品中的OxygenOS和HydrogenOS OTAs存在安全漏洞。攻击者可利用该漏洞实施降级攻击。以下产品受到影响：OnePlus One；OnePlus X；OnePlus 2；OnePlus 3；OnePlus 3T。
CVSS信息
N/A
漏洞类别
输入验证错误