Roee Hay

The issue is an information disclosure vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

An issue allows an attacker to reboot the device into the Qualcomm Emergency Download (EDL) mode, potentially enabling the downgrading of partitions such as the Android Bootloader. This can be achieved through ADB or by using the Volume-Up button when connected to USB.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is due to the class improperly passing an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This method improperly passes an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This method improperly passes an attacker-controlled pointer to a native function, potentially leading to code execution.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is due to the improper passing of an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is due to the class improperly passing an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is done by improperly passing an attacker-controlled pointer to a native function.

The issue is related to insufficient validation of the SBL1 partition by the Primary Bootloader, which contains a certificate. This allows attackers with write access to the SBL1 partition to disable signature validation, potentially leading to unauthorized execution of code. The vulnerability is associated with inadequate access control and certificate checking by the bootloader.

The issue is related to a debugger in the Linux kernel's FIQ, which has inadequate access control. This could allow a remote attacker to elevate privileges and execute arbitrary code within the kernel context using a local malicious application. The problem is considered serious due to the potential for local permanent device compromise, which might necessitate reflashing the operating system to repair the device.

The issue is caused by a missing bounds check in the Linux kernel, specifically in the drivers/char/lp.c file. This allows an adversary with partial control over the kernel command line, potentially due to bootloader vulnerabilities, to overflow the parport nr array by appending multiple 'lp=none' arguments. The vulnerability can be exploited to cause a denial of service.

The issue is related to an elevation of privilege vulnerability in the Motorola bootloader, which could allow a local malicious application to execute arbitrary code within the context of the bootloader. This may lead to a local permanent device compromise, requiring reflashing the operating system to repair the device. The vulnerability is also described as being related to insufficient access control in the Motorola bootloader, potentially allowing an attacker to execute arbitrary code.

An issue allows attackers to install OTAs of one product over the other, even on locked bootloaders, due to a lenient updater-script and shared OTA verification keys. This could lead to the exploitation of patched vulnerabilities and expansion of the attack surface. The device may become unusable until a Factory Reset is performed. The vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process, as it does not occur over TLS. Physical attackers can also reboot the phone into recovery and use 'adb sideload' to push the OTA.

The issue allows for downgrade attacks due to a lenient 'updater-script' in OTAs that does not check the current version against the given image's version. This enables downgrades to occur even on locked bootloaders and without triggering a factory reset, potentially exploiting now-patched vulnerabilities and accessing user data. The vulnerability can be exploited by a Man-in-the-Middle (MiTM) attacker targeting the update process, as the update transaction does not occur over TLS. Additionally, a physical attacker can reboot the phone into recovery and use 'adb sideload' to push the OTA, provided 'Secure Start-up' is off on OnePlus 3/3T devices.

An issue allows attackers to install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders. This enables exploitation of vulnerabilities patched on one image but not on the other and expands the attack surface. The vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process, as it does not occur over TLS. Physical attackers can also reboot the phone into recovery and use 'adb sideload' to push the OTA, provided 'Secure Start-up' is off on OnePlus 3 and 3T devices.

The issue allows an unauthorized attacker to partially dump the ciphertext content of an arbitrary partition, except 'keystore', by using the 'fastboot oem dump <partition>' command. This affects OnePlus 3 and 3T devices.

The issue is related to an elevation of privilege vulnerability in the HTC OEM fastboot command, which could allow a local malicious application to execute arbitrary code within the context of the sensor hub. This vulnerability is rated as Moderate because it first requires exploitation of separate vulnerabilities.

The issue allows a malicious charger or a physical attacker to open an ADB session with the device without authorization when a charger is connected to a powered-off device. This can be used to further exploit other vulnerabilities and/or exfiltrate sensitive information.

An issue was discovered that allows an attacker to change the boot mode of the device by issuing a specific command, contradicting the Android threat model where the bootloader should not allow security-sensitive operations unless it is unlocked.

An issue in OxygenOS allows an attacker to persistently disable dm-verity, which is used by the kernel to verify the system partition, by issuing the `fastboot oem disable dm verity` command. This may allow for persistent code execution and privilege escalation. The vulnerability is related to insufficient access control and can be exploited remotely to gain root privileges and block warnings about system partition replacement.