Root Exploits

This page contains a general summary of root exploits/exploit chains published for webOS at some point.


NamePublishedPatchedNotes
GetMeIn2019/01/082024/04/20Mitigated in devmode jail config update
RootMyTV v12021/02/11~2021Mitigated in facebooklogin system app udpate
RootMyTV v22022/01/14~2022/05Mitigated in firmware update
crashd2022/07/04, 2023/01/192024/04/02Mitigated in devmode jail config update
WTA2024/04/01~2024/04Mitigated in firmware update
asm command injection2024/04/092024/03/22Mitigated in firmware update (before publishing)
dejavuln2024/04/202024/05/??Mitigated in firmware update
NVM Debug Mode2023/01/18-Applies only to webOS 3.x and older, requires hardware mod
faultmanager2024/01/04-Applies to webOS 3.5 and newer

Vulnerabilities listed as mitigated in firmware update should be exploitable if device is running sufficiently old firmware version.

Vulnerabilities listed as mitigated in system app update should be exploitable if device is running sufficiently old firmware version and exploit is carried out before letting the device contact LG services. (responsible for system apps updates)

Vulnerabilities listed as mitigated in devmode jail config update are unlikely to be exploitable. (since devmode needs to be refreshed, and that requires network connection, and thus - leads to a jail config update)

GetMeIn


One of the first public LG webOS root exploit chains, originally published on xda-developers.

Misconfigured devmode jail config allowed for direct system memory read/write (/dev/mem) on certain platforms.

For a long time people were convinced this was fully patched, though only in 2024/04 LG finally patched a bug in devmode jail config that allowed rollbacks (that was published sometime in late 2023, see crashd exploit guide linked below) and thus kept this exploitable.

RootMyTV v1


Single-click root exploit chain based on a published arbitrary file write vulnerability feature. Summary of an exploit chain available in RootMyTV repo.

Broken mitigation (download whitelists) rolled out in firmware update was worked around in v2.

start-devmode.sh used as a root code exection hook is now signed (thus can't be used anymore) and presence of an unsigned/mis-signed file breaks developer mode.

RootMyTV v2


Updated version of RootMyTV. Summary present in RootMyTV repo readme contains description of changes introduced in v2.

extra_conf.sh used as root code execution hook was removed in a firmware update.

crashd


Command injection bug in clouduploadd service originally discovered and published on webosforums.ru by whiterat.

Full guide by throwaway96 was published.

Underlying vulnerability in clouduploadd was independently discovered by Bitdefender and assigned CVE-2023-6318.

WTA


USB file-based backdoor - see guide by throwaway96.

Discovered a long time ago by Mariotaku (2021/05/29, OpenLGTV team), though only published after patch started getting rolled out.

Independently discovered and reported by redfr0g and assigned CVE-2024-1886.

asm command injection


Command injection in com.webos.service.attachedstoragemanager/getAudioMetadata (asm service) was discovered, reported and patched before publishing by Bitdefender, assigned CVE-2023-6319.

Exploit for this vulnerability was published by ixion.

dejavuln


Essentially the same vulnerable code as in asm service listed above was present in cbox. This was discovered by Jacob Clayden and published by throwaway96 as dejavuln-autoroot.

NVM Debug Mode


Debug mode built into webOS allows for root code execution over serial. Debug mode flag was stored on unencrypted/unsigned EEPROM on platforms before 2018 (webOS 3.x).

A guide on how to identify the EEPROM and apply relevant changes was published by throwaway96.

faultmanager


Exploit chain utilizing a vulnerability in the faultmanager service. Published by throwaway96 as faultmanager-autoroot. Applies to webOS 3.5 and newer versions.