4 ms·
https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11976 https://www.qualcomm.com/company/product-security/bulletins#... That's pretty much
by AdmiralAsshat 8y ago
https://www.qualcomm.com/company/product-security/bulletins#_CVE-2018-11976 https://www.qualcomm.com/company/product-security/bulletins#...
That's pretty much all the snapdragons in modern Android phones (page is not letting me copy+paste them here).
Has QC put out a patch yet?
EDIT: The April security patch looks like it took care of it:
https://source.android.com/security/bulletin/2019-04-01 https://source.android.com/security/bulletin/2019-04-01
EDIT 2: And of course, my Samsung Galaxy S8+, despite having received an update in April, is only at the March 1st security patch level. So I'm likely vulnerable until Samsung's next update.
- wyldfire 8y agoYes. From the article: > Recommendation > Qualcomm has already designed and distributed a patch to address this issue. Ensure that your devices are running the most recent firmware version. Also, here's the list from that page: IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130
- Ajedi32 8y agoDo firmware updates typically get distributed along with OS updates on Android, or is there some other process you'd need to use to patch those device?
- zifnab06 8y agoThey're delivered along with normal updates.
- AdmiralAsshat 8y agoThanks, I was hoping to figure out when it was distributed. But your comment encouraged me to search for the CVE, and it looks like it was fixed in the Android 04-05 security patch: https://source.android.com/security/bulletin/2019-04-01 https://source.android.com/security/bulletin/2019-04-01
- phh 8y agoFor vendor patches, you really can't trust that value in any way... I'm afraid there is no real way to check, except for trying the attack. Qualcomm patches are not distributed as part of AOSP security patches, and is not tested for Google certification, so there is really no reason for it to be accurate, except possibly for Pixels.
- Jonnax 8y agoI remember reading that phone manufacturers sometimes update the patch version but don't pull all the patches presumably because it's too much effort to integrate into their forked codebases.
- phh 8y agoThat's assuming Galaxy S8+ is using Qualcomm's keymaster, I'm not too sure. Considering how Samsung is focused on security, I wouldn't be suprised if they'd use external security element like Google does on Pixel 3.
- Arnavion 8y ago>(page is not letting me copy+paste them here) `user-select: none` in the `.slick-slider` CSS rule. User-hostility at its finest. Sigh...