3 ms·

>The Original Discovery of the Bug >This bug was originally found and reported in November 2017 and patched in February 2018. Syzbot, a syzkaller system that c

by Groxx 7y ago

>The Original Discovery of the Bug >This bug was originally found and reported in November 2017 and patched in February 2018. Syzbot, a syzkaller system that continuously fuzzes the Linux kernel, originally reported the use-after-free bug to Linux kernel mailing lists and the syzkaller-bugs mailing list in November 2017. From this report, the bug was patched in the Linux 4.14, Android 3.18, Android 4.4, and Android 4.9 kernels in February 2018. However, this fix was never included in an Android monthly security bulletin and thus the bug was never patched in many already released devices, such as Pixel and Pixel 2. Yea, that's a very large number of active devices, for a bug that's believed to be actively exploited. Roughly 75% going by this: https://android.stackexchange.com/questions/51651/which-android-runs-which-linux-kernel https://android.stackexchange.com/questions/51651/which-andr... plus https://developer.android.com/about/dashboards https://developer.android.com/about/dashboards

bscphil 7y ago
Even my currently supported device (Moto x4) is vulnerable because it hasn't received the October 6 patch. It's more than halfway through November, and I'm still on the October 1st patch. The vendor patching system is pretty terrible with Android and ends up leaving many devices vulnerable to publicly known exploits most of the time.
- sigmar 7y ago
  You don't need this patched. moto x4 has had this patched since the release of pie. You can check for yourself at the source code here: https://github.com/MotorolaMobilityLLC/kernel-msm/blob/MMI-PPW29.69-26/drivers/android/binder.c https://github.com/MotorolaMobilityLLC/kernel-msm/blob/MMI-P... Most devices already have the patch from the upstream kernel: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/android/binder.c?h=linux-4.14.y&id=7a3cee43e935b9d526ad07f20bf005ba7e74d05b https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
  - bscphil 7y ago
    That's good news, thanks.

by Groxx 7y ago

bscphil 7y ago

Even my currently supported device (Moto x4) is vulnerable because it hasn't received the October 6 patch. It's more than halfway through November, and I'm still on the October 1st patch. The vendor patching system is pretty terrible with Android and ends up leaving many devices vulnerable to publicly known exploits most of the time.

sigmar 7y ago
You don't need this patched. moto x4 has had this patched since the release of pie. You can check for yourself at the source code here: https://github.com/MotorolaMobilityLLC/kernel-msm/blob/MMI-PPW29.69-26/drivers/android/binder.c https://github.com/MotorolaMobilityLLC/kernel-msm/blob/MMI-P... Most devices already have the patch from the upstream kernel: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/drivers/android/binder.c?h=linux-4.14.y&id=7a3cee43e935b9d526ad07f20bf005ba7e74d05b https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux...
- bscphil 7y ago
  That's good news, thanks.