Roeehay

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is done by improperly passing an attacker-controlled pointer to a native function.

An issue allows an attacker to reboot the device into the Qualcomm Emergency Download (EDL) mode, potentially enabling the downgrading of partitions such as the Android Bootloader. This can be achieved through ADB or by using the Volume-Up button when connected to USB.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is due to the class improperly passing an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This method improperly passes an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This method improperly passes an attacker-controlled pointer to a native function, potentially leading to code execution.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is due to the improper passing of an attacker-controlled pointer to a native function.

The issue allows attackers to execute arbitrary code by leveraging a finalize method in a Serializable class. This is due to the class improperly passing an attacker-controlled pointer to a native function.

The issue is related to insufficient validation of the SBL1 partition by the Primary Bootloader, which contains a certificate. This allows attackers with write access to the SBL1 partition to disable signature validation, potentially leading to unauthorized execution of code. The vulnerability is associated with inadequate access control and certificate checking by the bootloader.

The issue is related to a debugger in the Linux kernel's FIQ, which has inadequate access control. This could allow a remote attacker to elevate privileges and execute arbitrary code within the kernel context using a local malicious application. The problem is considered serious due to the potential for local permanent device compromise, which might necessitate reflashing the operating system to repair the device.

The issue is caused by a missing bounds check in the Linux kernel, specifically in the drivers/char/lp.c file. This allows an adversary with partial control over the kernel command line, potentially due to bootloader vulnerabilities, to overflow the parport nr array by appending multiple 'lp=none' arguments. The vulnerability can be exploited to cause a denial of service.

An issue allows attackers to install HydrogenOS over OxygenOS and vice versa, even on locked bootloaders. This enables exploitation of vulnerabilities patched on one image but not on the other and expands the attack surface. The vulnerability can be exploited by Man-in-the-Middle (MiTM) attackers targeting the update process, as it does not occur over TLS. Physical attackers can also reboot the phone into recovery and use 'adb sideload' to push the OTA, provided 'Secure Start-up' is off on OnePlus 3 and 3T devices.

The issue allows an unauthorized attacker to partially dump the ciphertext content of an arbitrary partition, except 'keystore', by using the 'fastboot oem dump <partition>' command. This affects OnePlus 3 and 3T devices.

The issue allows a malicious charger or a physical attacker to open an ADB session with the device without authorization when a charger is connected to a powered-off device. This can be used to further exploit other vulnerabilities and/or exfiltrate sensitive information.

An issue was discovered that allows an attacker to change the boot mode of the device by issuing a specific command, contradicting the Android threat model where the bootloader should not allow security-sensitive operations unless it is unlocked.

An elevation of privilege issue in the kernel FIQ debugger could allow a local malicious application to execute arbitrary code within the context of the kernel. This issue may lead to a local permanent device compromise, potentially requiring reflashing the operating system to repair the device. The vulnerability is related to insufficient access control in the kernel FIQ debugger.