OnePlus security flaws allow unauthorized root access

Security researcher Rasmus Moorats has discovered two vulnerabilities in OnePlus’s OxygenOS that allow a malicious application to gain full root access to a device without user authorization or alerts.

The exploit involves chaining two proprietary components. The first flaw resides in AtlasService, a diagnostic data collection component that runs with root privileges and fails to verify the origin of software calls. By sending a specifically crafted request, an application can inject unfiltered text into a system command to gain limited root access to a technical area known as dumpstate.

A second flaw in the olc2 hardware management service allows the attacker to escalate this access. Because olc2 executes any shell instruction provided it comes from a root process, the access gained via AtlasService allows an application to obtain full low-level Linux privileges, including the ability to load code at the kernel level.

Tests successfully demonstrated this exploit on both a OnePlus 12 Pro and a OnePlus 15 running unmodified software. While OnePlus confirmed the vulnerabilities, the company has not yet released a patch or a CVE, and reportedly asserted exclusive rights over the disclosure timeline.