CVE-2017-11105
📋 TL;DR
The OnePlus 2 bootloader fails to validate the SBL1 partition signature before execution, allowing attackers with write access to that partition to disable signature validation entirely. This affects OnePlus 2 smartphone users who have not applied security patches. Attackers could gain persistent control over the device boot process.
💻 Affected Systems
- OnePlus 2 smartphone
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with persistent rootkit installation, allowing attackers to intercept all communications, steal credentials, and maintain permanent access even after factory resets.
Likely Case
Targeted attacks against specific users to install surveillance malware or ransomware that survives device wipes.
If Mitigated
Limited to physical access attacks or attacks requiring prior device compromise through other vulnerabilities.
🎯 Exploit Status
Exploitation requires physical access or ability to flash partitions. Technical details and proof-of-concept available in research publications.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OxygenOS updates released after vulnerability disclosure (specific version numbers not publicly documented)
Vendor Advisory: https://forums.oneplus.com/threads/security-bulletin-for-oneplus-devices.458423/
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System updates. 2. Install latest OxygenOS update. 3. Reboot device. 4. Verify bootloader security features are enabled.
🔧 Temporary Workarounds
Enable verified boot
androidEnsure verified boot is enabled to validate boot chain integrity
Lock bootloader
androidKeep bootloader locked to prevent unauthorized partition writes
🧯 If You Can't Patch
- Restrict physical access to devices
- Implement mobile device management (MDM) with integrity checking
🔍 How to Verify
Check if Vulnerable:
Check if device is OnePlus 2 and has not received security updates since 2017. Review bootloader security settings.Check Version:
Settings > About phone > OxygenOS versionVerify Fix Applied:
Verify latest OxygenOS version is installed and bootloader reports verified boot as active.📡 Detection & Monitoring
Log Indicators:
- Bootloader warning messages
- Failed verified boot attempts
- Unexpected partition modification timestamps
Network Indicators:
- Unusual device behavior post-boot
- Suspicious outbound connections during early boot phase
SIEM Query:
Device logs showing boot integrity failures or bootloader security events