{"id":"CVE-2026-70387","kind":"vulnerability","aliases":["CVE-2026-70387"],"related":[],"title":"OnePlus OxygenOS: logging HAL lets root-level callers run arbitrary shell commands","description":"Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder method that fork()'s and calls execl(\"/vendor/bin/sh\", \"sh\", \"-c\", cmd, NULL) with a caller-supplied command string. The only authorization check is getCallingUid() == 0. Because SELinux policy grants binder access to this HAL to a wide client attribute, any uid-0 process in any of those domains (including dumpstate, which is reachable from an unprivileged app via Vulnerability 1) obtains arbitrary command execution. The spawned shell lands in u:r:vendor_qti_init_shell:s0 SELinux context via a policy type_transition, a domain holding all Linux capabilities. This issue affects OxygenOS: from 16.1.0 before 16.1.10.500, from 16.0.0 before 16.0.5.1200, and from 15.0.0 before 15.0.0.2000.","summary":"The olc2 logging HAL on OnePlus OxygenOS exposes a binder method that runs a caller-supplied command through /vendor/bin/sh, and it only checks that the caller is uid 0. A process that reaches root in one of the allowed SELinux domains, such as dumpstate reached from an unprivileged app, can run arbitrary commands in a context holding all Linux capabilities.","severity":"high","cvss":8.4,"epss":0.00128,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["android","mobile-fleet","oneplus","oxygenos","vendor"],"not_affected_if":["non-oneplus-device","patched-build"],"how_to_check":"- Settings > About phone > check the OxygenOS version; the affected builds are 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000\n- unknown for any other method of checking the olc2 HAL on a device","fix":"- Update OxygenOS to `16.1.10.500` or later on the 16.1 line, `16.0.5.1200` or later on the 16.0 line, or `15.0.0.2000` or later on the 15.0 line\n- unknown for a vendor-side mitigation if the device cannot be updated","status":"open","published_at":"2026-10-21T09:17:07+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:01:45+00:00","updated_at":"2026-10-25T03:01:45+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:01:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update OxygenOS to `16.1.10.500` or later on the 16.1 line, `16.0.5.1200` or later on the 16.0 line, or `15.0.0.2000` or later on the 15.0 line\n- unknown for a vendor-side mitigation if the device cannot be updated","reach":"local","title":"OnePlus OxygenOS: logging HAL lets root-level callers run arbitrary shell commands","impact":"high","summary":"The olc2 logging HAL on OnePlus OxygenOS exposes a binder method that runs a caller-supplied command through /vendor/bin/sh, and it only checks that the caller is uid 0. A process that reaches root in one of the allowed SELinux domains, such as dumpstate reached from an unprivileged app, can run arbitrary commands in a context holding all Linux capabilities.","category":"vendor","nicknames":[],"who_cares":["android","oneplus","oxygenos","mobile-fleet"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs arbitrary commands with full Linux capabilities on the device","analyst_note":"Confirm the exact fixed build numbers and whether a non-root user path exists via the dumpstate chain (Vulnerability 1) on the NVD page for CVE-2026-70387.","how_to_check":"- Settings > About phone > check the OxygenOS version; the affected builds are 16.1.0 before 16.1.10.500, 16.0.0 before 16.0.5.1200, and 15.0.0 before 15.0.0.2000\n- unknown for any other method of checking the olc2 HAL on a device","needs_analyst":true,"not_affected_if":["patched-build","non-oneplus-device"],"who_is_affected":"Owners of OnePlus devices running the affected OxygenOS builds are exposed, since the flaw sits in the vendor logging HAL on the device itself. The sources do not describe a server or developer-side exposure. Devices already on the fixed builds, and devices running other Android vendors' software, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":3595,"output_tokens":739,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-0':151C '-2026':15A,18A '-70387':16A,19A '/vendor/bin/sh':46B,116C '0':56B,134C '1':169C '15.0.0':213C '15.0.0.2000':215C '16.0.0':208C '16.0.5.1200':210C '16.1.0':204C '16.1.10.500':206C 'access':140C 'affect':201C 'allow':66B 'android':20B,101C 'app':76B,166C 'arbitrari':11A,79B,171C 'attribut':148C 'author':95C,130C 'binder':36B,108C,139C 'c':118C 'call':114C 'caller':9A,42B,53B,124C 'caller-suppli':41B,123C 'capabl':87B,198C 'check':50B,131C 'client':147C 'cmd':119C 'command':13A,44B,80B,126C,172C 'context':83B,187C 'cve':14A,17A 'danger':89C 'domain':68B,157C,194C 'dumpstat':71B,159C 'execl':115C 'execut':173C 'expos':34B,88C,106C 'fleet':23B 'fork':111C 'function':92C 'getcallinguid':133C 'grant':138C 'hal':4A,30B,105C,143C 'hold':84B,195C 'includ':158C 'incorrect':94C 'init':183C 'issu':200C 'land':177C 'let':5A 'level':8A 'linux':86B,197C 'log':3A,29B,104C 'method':37B,90C,109C 'mobil':22B 'mobile-fleet':21B 'null':120C 'obtain':170C 'olc2':28B,103C 'one':63B 'oneplus':1A,24B,32B,98C 'oxygeno':2A,25B,33B,99C,202C 'polici':137C,190C 'process':58B,152C 'qti':182C 'r':180C 'reach':60B,72B 'reachabl':162C 'root':7A,61B 'root-level':6A 'run':10A,39B,78B 's0':185C 'selinux':67B,136C,186C 'sh':117C 'shell':12A,176C,184C 'spawn':175C 'string':127C 'suppli':43B,125C 'transit':192C 'type':191C 'u':179C 'uid':55B,150C 'unprivileg':75B,165C 'vendor':26B,181C 'via':167C,188C 'vulner':96C,168C 'wide':146C","nicknames":[],"mitigations":[],"who_affected":"Owners of OnePlus devices running the affected OxygenOS builds are exposed, since the flaw sits in the vendor logging HAL on the device itself. The sources do not describe a server or developer-side exposure. Devices already on the fixed builds, and devices running other Android vendors' software, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T09:17:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-70387","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-70387","severity":null,"published_at":"2026-10-21T09:17:07+00:00","modified_at":"2026-10-22T16:58:51+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-70387","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-70387","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}