4 ms·

Fixed in https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf https://android.googlesource.com/platform/system/bt/+/3c

by morsch 7y ago

Fixed in https://android.googlesource.com/platform/system/bt/+/3cb7149d8fed2d7d77ceaa95bf845224c4db3baf https://android.googlesource.com/platform/system/bt/+/3cb714... of https://source.android.com/security/bulletin/2020-02-01 https://source.android.com/security/bulletin/2020-02-01: - packet->len = partial_packet->len - partial_packet->offset; + packet->len = + (partial_packet->len - partial_packet->offset) + packet->offset; I wonder how many devices are running that patch level.

GekkePrutser 7y ago
Strange that the commit is from 2018 but it was only included in the patch level of February 5? At least Samsung is pretty good about updating patches. Not android versions, no, but at least I still get monthly patches. My S8 already has this one.
- morsch 7y ago
  It's not from 2018 -- Thu Apr 18 17:13:49 2019 -- the 18 may have tripped you up, it's the day of month. It's still a year old, though. It's a cherry-pick (a copy of a commit from related code base, essentially) of this commit, https://android.googlesource.com/platform/system/bt/+/337bd4579453bd6bf98ff519de3ac1019cd30d28%5E%21/ https://android.googlesource.com/platform/system/bt/+/337bd4.... The bug has a different impact in Android 10 (DOS instead of RCE), which was relased in Septemer 2019. So maybe they sort of fixed it in Android 10 and somehow forgot the backport? I'm speculating.
- realusername 7y ago
  Depends which Samsung you have, my last Samsung update was on the 4th of January. Support for their non-flagship devices isn't great.
kuschku 7y ago
My Google Pixel 1 isn’t running this patch level, because Google dropped support for it entirely. Which just sucks, because there’s no reason not to support it anymore, it’s just planned obsolescence.
- Paianni 7y ago
  The Pixel 1's kernel and drivers are no longer maintained upstream.
  - dmitrygr 7y ago
    which is irrelevant for this userspace-only fix
  - samoa42 7y ago
    are you saying google cannot afford to maintain it/them?
    - Paianni 7y ago
      Basically they could maintain the Android environment but it wouldn't mean much because the system's still not safe, and won't be unless the device gets a new kernel + rebuilt drivers.
      - pjmlp 7y ago
        Which they could easily do with support contract requirements. I assume Google can afford a couple of lawyers.
  - fulafel 7y ago
    Do you mean there's a Linux tree upstream of Google but downstream from Linus who have stopped work outside of Google control?
    - Paianni 7y ago
      It's all dependant on Linus' version being maintained.
    - DCKing 7y ago
      Yes, sort of. Google depends on Qualcomm to make updated drivers, as Qualcomm owns the intellectual property. All Pixel phones are based on a Qualcomm platform. Qualcomm stops supporting their processors after a few years, usually three. They can make more money by selling new chips. Although I say this cynically, Qualcomm is actually the best third party vendor in this regard.
throwaway888abc 7y ago
Yeah, There is guaranteed window of many phones/manufactures that the patch will be 6 months or never far away.

by morsch 7y ago

GekkePrutser 7y ago

Strange that the commit is from 2018 but it was only included in the patch level of February 5? At least Samsung is pretty good about updating patches. Not android versions, no, but at least I still get monthly patches. My S8 already has this one.

morsch 7y ago
It's not from 2018 -- Thu Apr 18 17:13:49 2019 -- the 18 may have tripped you up, it's the day of month. It's still a year old, though. It's a cherry-pick (a copy of a commit from related code base, essentially) of this commit, https://android.googlesource.com/platform/system/bt/+/337bd4579453bd6bf98ff519de3ac1019cd30d28%5E%21/ https://android.googlesource.com/platform/system/bt/+/337bd4.... The bug has a different impact in Android 10 (DOS instead of RCE), which was relased in Septemer 2019. So maybe they sort of fixed it in Android 10 and somehow forgot the backport? I'm speculating.
realusername 7y ago
Depends which Samsung you have, my last Samsung update was on the 4th of January. Support for their non-flagship devices isn't great.

kuschku 7y ago

My Google Pixel 1 isn’t running this patch level, because Google dropped support for it entirely. Which just sucks, because there’s no reason not to support it anymore, it’s just planned obsolescence.

Paianni 7y ago
The Pixel 1's kernel and drivers are no longer maintained upstream.
- dmitrygr 7y ago
  which is irrelevant for this userspace-only fix
- samoa42 7y ago
  are you saying google cannot afford to maintain it/them?
  - Paianni 7y ago
    Basically they could maintain the Android environment but it wouldn't mean much because the system's still not safe, and won't be unless the device gets a new kernel + rebuilt drivers.
    - pjmlp 7y ago
      Which they could easily do with support contract requirements. I assume Google can afford a couple of lawyers.
- fulafel 7y ago
  Do you mean there's a Linux tree upstream of Google but downstream from Linus who have stopped work outside of Google control?
  - Paianni 7y ago
    It's all dependant on Linus' version being maintained.
  - DCKing 7y ago
    Yes, sort of. Google depends on Qualcomm to make updated drivers, as Qualcomm owns the intellectual property. All Pixel phones are based on a Qualcomm platform. Qualcomm stops supporting their processors after a few years, usually three. They can make more money by selling new chips. Although I say this cynically, Qualcomm is actually the best third party vendor in this regard.

throwaway888abc 7y ago

Yeah, There is guaranteed window of many phones/manufactures that the patch will be 6 months or never far away.