Getting root on OnePlus 15 from an untrusted app
Two chained OxygenOS flaws let any sideloaded APK gain uid 0 root on OnePlus 15; patches rolled out to 151 devices with 18 pending.
A researcher demonstrated a full untrusted_app-to-uid-0 privilege escalation chain on the OnePlus 15 running OxygenOS 16 using two flaws. The AtlasService telemetry service accepts binder calls from any app without permission checks, allowing command injection when an attacker-controlled property value is passed unescaped to system() by audioDumpInfo; the olc2 vendor HAL then exposes a doShell method that runs arbitrary shell commands for uid-0 callers. The PoC APK required no special permissions and worked first try on an unmodified device. OnePlus confirmed the issues affect many OnePlus and OPPO devices, fixed them in OxygenOS 16.0.10.500(EX01) on the OnePlus 15, and stated 151 devices have been patched with 18 pending.
- AtlasService accepts unauthenticated binder calls, enabling root command injection via property values
- olc2 HAL doShell method executes arbitrary shell commands for any uid-0 caller
- Chain yields full uid 0 root from a plain APK with no permissions
- Fixed in OnePlus 15 OxygenOS 16.0.10.500(EX01); affects many OnePlus/OPPO devices
- OnePlus says 151 devices patched, 18 pending release
From the original article
12 min read at blog.nns.ee
I've been using OnePlus phones since the OnePlus 3T. I'm currently on a OnePlus 15 (CPH2747) running OxygenOS 16, which I've had for a few months now and am pretty happy with. I figured I'd poke at the firmware a bit to see what's in there.
By blog.nns.ee via lknuth · blog.nns.ee
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.