Critical Root Vulnerability in OnePlus Devices Remains Unpatched

• •OnePlus devices can be rooted by malicious apps without user permissions.
• •Two flaws in OnePlus's software chain together to enable root access.
• •OnePlus has not yet issued a patch or CVE for the vulnerabilities.

A security researcher discovered a critical vulnerability in OnePlus devices, including the OnePlus 15, allowing installed apps to gain root access without user permissions. The researcher, Rasmus Moorats, identified two flaws in OnePlus's custom software that enable this exploit. The first flaw, in AtlasService, allows any app to execute commands as root, while the second flaw in the olc2 service executes shell commands without adequate checks. Despite reporting the vulnerabilities five months ago, OnePlus has yet to issue a patch or assign a CVE. The flaws affect multiple OnePlus and OPPO devices running OxygenOS, with no public list of affected models provided. The exploit is local, requiring the user to install a malicious app, but poses a significant risk as it can be triggered without any special permissions or prompts.