Google says Google and other Android manufacturers haven't patched security flaws

K. Holt@krisholtNovember 24, 2022 1:30 PMIn this post: android, information, mali, equipment, samsung, arm, google, security, smartphone, pixel, exynos, xiaomi, exploit, oppoDado Ruvic / reuters

Google has disclosed various security flaws for phones that have Mali GPUs, this sort of as people with Exynos SoCs. The firm’s Venture Zero workforce suggests it flagged the troubles to ARM (which types the GPUs) back again in the summer season. ARM resolved the issues on its close in July and August. Nonetheless, smartphone manufacturers like Samsung, Xiaomi, Oppo and Google by itself hadn’t deployed patches to repair the vulnerabilities as of earlier this 7 days, Venture Zero explained.

Scientists identified 5 new issues in June and July and immediately flagged them to ARM. “1 of these issues led to kernel memory corruption, a single led to physical memory addresses staying disclosed to userspace and the remaining a few led to a physical web site use-right after-free problem,” Undertaking Zero’s Ian Beer wrote in a weblog article. “These would enable an attacker to continue on to browse and produce actual physical internet pages immediately after they experienced been returned to the procedure.”

Beer famous that it would be probable for a hacker to acquire comprehensive entry to a system as they’d be equipped to bypass the permissions model on Android and attain “wide accessibility” to a user’s info. The attacker could do so by forcing the kernel to reuse the afore-talked about bodily pages as site tables.

Switch on browser notifications to receive breaking news alerts from EngadgetYou can disable notifications at any time in your settings menu.Not nowTurn onTurned onTurn on

Job Zero found that, three months right after ARM preset these issues, all of the team’s take a look at products had been nonetheless vulnerable to the flaws. As of Tuesday, the issues were being not outlined “in any downstream security bulletins” from Android manufacturers.

Engadget has contacted Google, Samsung, Oppo and Xiaomi to talk to when they will deploy the fixes to their Android units and why it has taken so extended for them to do so. As SamMobile notes, Samsung’s Galaxy S22 series devices and the company’s Snapdragon-run handsets aren’t afflicted by these vulnerabilities.

All products and solutions encouraged by Engadget are chosen by our editorial workforce, impartial of our father or mother corporation. Some of our tales contain affiliate hyperlinks. If you purchase a little something by way of one of these one-way links, we might receive an affiliate commission. All rates are proper at the time of publishing.


Some parts of this article are sourced from:
engadget.com