| Name | Published | Patched | Notes |
|---|---|---|---|
| GetMeIn | 2019/01/08 | 2024/04/20 | Mitigated in devmode jail config update |
| RootMyTV v1 | 2021/02/11 | ~2021 | Mitigated in facebooklogin system app udpate |
| RootMyTV v2 | 2022/01/14 | ~2022/05 | Mitigated in firmware update |
| crashd | 2022/07/04, 2023/01/19 | 2024/04/02 | Mitigated in devmode jail config update |
| WTA | 2024/04/01 | ~2024/04 | Mitigated in firmware update |
| asm command injection | 2024/04/09 | 2024/03/22 | Mitigated in firmware update (before publishing) |
| dejavuln | 2024/04/20 | 2024/05/?? | Mitigated in firmware update |
| NVM Debug Mode | 2023/01/18 | - | Applies only to webOS 3.x and older, requires hardware mod |
| faultmanager | 2024/01/04 | - | Applies to webOS 3.5 and newer |
Vulnerabilities listed as mitigated in firmware update should be exploitable if device is running sufficiently old firmware version.
Vulnerabilities listed as mitigated in system app update should be exploitable if device is running sufficiently old firmware version and exploit is carried out before letting the device contact LG services. (responsible for system apps updates)
Vulnerabilities listed as mitigated in devmode jail config update are unlikely to be exploitable. (since devmode needs to be refreshed, and that requires network connection, and thus - leads to a jail config update)
GetMeIn
One of the first public LG webOS root exploit chains, originally published on xda-developers.
Misconfigured devmode jail config allowed for direct system memory read/write
(/dev/mem) on certain platforms.
For a long time people were convinced this was fully patched, though only
in 2024/04 LG finally patched a bug in devmode jail config that allowed rollbacks
(that was published sometime in late 2023, see crashd exploit guide linked
below) and thus kept this exploitable.
RootMyTV v1
Single-click root exploit chain based on a published arbitrary file write
vulnerability feature. Summary of an
exploit chain available in RootMyTV repo.
Broken mitigation (download whitelists) rolled out in firmware update was worked around in v2.
start-devmode.sh used as a root code exection hook is now signed (thus can't
be used anymore) and presence of an unsigned/mis-signed file breaks developer
mode.
RootMyTV v2
Updated version of RootMyTV. Summary present in RootMyTV repo readme contains description of changes introduced in v2.
extra_conf.sh used as root code execution hook was removed in a firmware
update.
crashd
Command injection bug in clouduploadd service originally discovered and published on
webosforums.ru by whiterat.
Full guide by throwaway96 was published.
Underlying vulnerability in clouduploadd was independently discovered by Bitdefender and assigned CVE-2023-6318.
WTA
USB file-based backdoor - see guide by throwaway96.
Discovered a long time ago by Mariotaku (2021/05/29, OpenLGTV team), though only published after patch started getting rolled out.
Independently discovered and reported by redfr0g and assigned CVE-2024-1886.
asm command injection
Command injection in com.webos.service.attachedstoragemanager/getAudioMetadata
(asm service) was discovered, reported and patched before publishing
by Bitdefender, assigned CVE-2023-6319.
Exploit for this vulnerability was published by ixion.
dejavuln
Essentially the same vulnerable code as in asm service listed above was
present in cbox. This was discovered by Jacob
Clayden and published by
throwaway96 as dejavuln-autoroot.
NVM Debug Mode
Debug mode built into webOS allows for root code execution over serial. Debug mode flag was stored on unencrypted/unsigned EEPROM on platforms before 2018 (webOS 3.x).
A guide on how to identify the EEPROM and apply relevant changes was published by throwaway96.
faultmanager
Exploit chain utilizing a vulnerability in the faultmanager service. Published by throwaway96 as faultmanager-autoroot. Applies to webOS 3.5 and newer versions.