'Patch Lag' Leaves Millions of Android Devices Vulnerable

[upnorth]

Content source

https://www.darkreading.com/mobile/-patch-lag-leaves-millions-android-devices-vulnerable

It's called a "patch gap" and describes the time it takes a fix for a known vulnerability to trickle down from software vendor to individual device manufacturers. And the latest casualties are the millions of Pixel, Samsung, Xiaomi, and other Android device brands.

According to Google's Project Zero, after its team discovered five separate bugs in the ARM Mali GPU driver, ARM "promptly" issued a patch in July and August. Yet, Project Zero reported that every test device they looked at this week remains vulnerable. Until there's a better solution for tightening up the lag between the time a patch is issued and reaches the wider ecosystem, it's up to security teams to remain "vigilant," the Google Project Zero team advised.

Companies need to remain vigilant, follow upstream sources closely, and do their best to provide complete patches to users as soon as possible.

'Patch Lag' Leaves Millions of Android Devices Vulnerable

 

[Ink]

The vulnerabilities are listed under CVE-2022-33917.

Google's Project Zero security research team has a blog post detailing exploits it found based within Arm's Mali GPU driver. Mobile chipsets from the likes of Samsung (Exynos), Google (Tensor), and MediaTek that include the GPU may be affected — not so much those owning devices running a Snapdragon SoC as those feature Qulacomm's own Adreno GPU design.

Google says that it reported these five issues to ARM months ago and they were promptly disclosed and fixed in the driver's source. Yet, later downstream testing had revealed that the fixes have not made it to user builds, resulting in phones that are still vulnerable even today — despite the fact that ARM fixed these issues as early as July. Even recent Tensor-equipped Google Pixel phones are affected.

The aim of the post is to get OEMs to "mind the patch gap" and do their best to roll out security fixes to users as soon as possible. With a public callout like this, your phone's manufacturer may be under pressure to pass along the patches — given your phone's maker cares, of course.

Non-Snapdragon devices at risk from GPU exploits that have already been patched

Your phone might be affected by these issues, so keep an eye out for your next security patch

www.androidpolice.com

 

[Zero Knowledge]

Google calls out Google for not patching vulnerabilities that Google discovered. Right....