Getting root on OnePlus 15 from an untrusted app
Summary
The article details two chained vulnerabilities in OnePlus OxygenOS that enable a local privilege escalation from an untrusted app to root. It explains how AtlasService allows command execution as root and how the olc2 HAL can spawn an unrestricted shell when invoked by uid 0, followed by a PoC and remediation updates.