Unpatched OnePlus Flaws Allow Installed Android Apps to Gain Root Access Without Permissions

Vulnerabilities Discovered

Security researcher Rasmus Moorats identified two vulnerabilities within OnePlus's OxygenOS that, when combined, enable an installed Android application to achieve root access on a device. This level of access grants the application full control over the Android phone, bypassing standard permission requirements. The exploit was demonstrated on a OnePlus 15 running the latest OxygenOS.

Technical Details of the Exploit

The first flaw resides in AtlasService, a OnePlus debugging service that runs as root and accepts calls from any application without authentication. A crafted call to this service allows an app to gain restricted root access within the dumpstate system zone. The second flaw is in olc2, a hardware helper service that executes any shell instruction it receives, provided the caller already has root privileges. By leveraging the restricted root access from the first flaw, an app can then use olc2 to gain full low-level Linux privileges, including the ability to load kernel code, thus achieving complete system control.

OnePlus's Response and Disclosure Dispute

OnePlus confirmed both flaws in May and indicated that they also affect other OnePlus and OPPO devices. However, the company had not released a fix by September 24, when Moorats publicly disclosed the vulnerabilities. OnePlus also asserted its "exclusive final right of vulnerability disclosure" and warned Moorats of potential legal liabilities if he published the findings without their consent, citing European cybersecurity rules.

Impact and User Action

The attack is local, meaning a malicious application must first be installed on the phone; it cannot be initiated remotely over the internet. Once installed, the app requires no user permissions or prompts to execute the exploit. There is no evidence of these flaws being actively exploited in the wild. As OnePlus has not yet released a patch, users of affected devices remain vulnerable to this type of local attack.