'Patch Lag' Leaves Millions of Android Devices Vulnerable

upnorth

Moderator
Thread author
Verified
Staff Member
Malware Hunter
Well-known
Jul 27, 2015
5,458
It's called a "patch gap" and describes the time it takes a fix for a known vulnerability to trickle down from software vendor to individual device manufacturers. And the latest casualties are the millions of Pixel, Samsung, Xiaomi, and other Android device brands.

According to Google's Project Zero, after its team discovered five separate bugs in the ARM Mali GPU driver, ARM "promptly" issued a patch in July and August. Yet, Project Zero reported that every test device they looked at this week remains vulnerable. Until there's a better solution for tightening up the lag between the time a patch is issued and reaches the wider ecosystem, it's up to security teams to remain "vigilant," the Google Project Zero team advised.
Companies need to remain vigilant, follow upstream sources closely, and do their best to provide complete patches to users as soon as possible.
'Patch Lag' Leaves Millions of Android Devices Vulnerable
 

Ink

Administrator
Verified
Staff Member
Well-known
Jan 8, 2011
22,361
The vulnerabilities are listed under CVE-2022-33917.
Google's Project Zero security research team has a blog post detailing exploits it found based within Arm's Mali GPU driver. Mobile chipsets from the likes of Samsung (Exynos), Google (Tensor), and MediaTek that include the GPU may be affected — not so much those owning devices running a Snapdragon SoC as those feature Qulacomm's own Adreno GPU design.

Google says that it reported these five issues to ARM months ago and they were promptly disclosed and fixed in the driver's source. Yet, later downstream testing had revealed that the fixes have not made it to user builds, resulting in phones that are still vulnerable even today — despite the fact that ARM fixed these issues as early as July. Even recent Tensor-equipped Google Pixel phones are affected.

The aim of the post is to get OEMs to "mind the patch gap" and do their best to roll out security fixes to users as soon as possible. With a public callout like this, your phone's manufacturer may be under pressure to pass along the patches — given your phone's maker cares, of course.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top