Lucene search

MitreCVE-2017-5625

HistoryApr 25, 2017 - 4:59 p.m.

CVE-2017-5625

2017-04-2516:59:00

CWE-476

mitre

web.nvd.nist.gov

oxygenos

oneplus

unauthorized access

partition dump

fastboot command

security vulnerability

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

30.5%

JSON

In OxygenOS before 4.0.3 on OnePlus 3 and 3T devices, an unauthorized attacker can cause a locked bootloader to partially dump the ciphertext content of an arbitrary partition (except ‘keystore’) by issuing the ‘fastboot oem dump <partition>’ fastboot command.

Affected configurations

Nvd

Node

oneplusoxygenosRange≤4.0.2

AND

oneplusoneplus_3Match-

oneplusoneplus_3tMatch-

VendorProductVersionCPE
oneplusoxygenos*cpe:2.3:o:oneplus:oxygenos:*:*:*:*:*:*:*:*
oneplusoneplus_3-cpe:2.3:h:oneplus:oneplus_3:-:*:*:*:*:*:*:*
oneplusoneplus_3t-cpe:2.3:h:oneplus:oneplus_3t:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
oneplus	oxygenos	*	cpe:2.3:o:oneplus:oxygenos::::::::
oneplus	oneplus_3	-	cpe:2.3:h:oneplus:oneplus_3:-:::::::*
oneplus	oneplus_3t	-	cpe:2.3:h:oneplus:oneplus_3t:-:::::::*

References

alephsecurity.com/vulns/aleph-2017006

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

4.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

4.8

Confidence

High

EPSS

0.001

Percentile

30.5%

JSON

Related for CVE-2017-5625