4 ms·

any grapheneOS users here who know if it's protected against this CVE?

ylk 4y ago
as far as I can tell GrapheneOS doesn't have the patch, yet. the most recent mention on their releases page is for the 2022120300 release: > kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro): update Mali GPU driver to r37p0 (current release is r41p0 but there are substantial changes to the driver for the Tensor SoC on Pixels and it will take substantial work to upgrade all the way) https://grapheneos.org/releases#2022120300 https://grapheneos.org/releases#2022120300 from the article: > The Arm security team were very helpful throughout and released a public patch in version r40p0 of the driver on 2022-10-07 to address the issue [...]
- gradeless 4y ago
  The writeup of the bug states that it was patched in the January update for Pixels, which GrapheneOS has. But previous work on applying mali patches early led to GarpheneOS having a fix earlier than stock Pixels https://github.com/GrapheneOS/os-issue-tracker/issues/1914#issuecomment-1401114851 https://github.com/GrapheneOS/os-issue-tracker/issues/1914#i...
  - strcat 4y ago
    Android 13 QPR2 Beta 1 came out on December 12th. This included backports of the ARM Mali GPU driver security along with a separate update to r38p1. GrapheneOS shipped these for the kernel driver. We had already done earlier work on updating the Mali GPU kernel drivers, but it's a lot more difficult for us because ARM doesn't make the standalone security patches available to the public and we don't currently have partner access to obtain them directly. We can ship them once Google or another vendor publishes the code. Generally, this will mean we can ship them once the next Android quarterly release Beta becomes available because they ship kernel patches months early in quarterly releases.
- strcat 4y ago
  > as far as I can tell GrapheneOS doesn't have the patch, yet. That's not correct. Android 13 QPR2 Beta 1 came out on December 12th. This included backports of the ARM Mali GPU driver security along with a separate update to r38p1. GrapheneOS shipped these for the kernel driver. > the most recent mention on their releases page is for the 2022120300 release: That's not the most recent mention on our releases page. This is the most recent relevant change: > full 2023-01-05 security patch level Here is a previous Mali GPU driver update: > kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to QPR2 Beta 2 release Here is another previous Mali GPU driver update: > kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to r38p1 along with other changes included in the QPR2 Beta 1 including a bunch of security fixes previously neglected upstream (GrapheneOS will continue applying further updates downstream) Looking at the version number is not enough. ARM makes separate security patches available to their partners. Google is primarily shipping the backported security patches and gradually upgrades the driver version. The reason for this is that there are massive changes to the Mali GPU kernel driver for the Tensor SoC GPU. This is why GrapheneOS can't simply update it to r41p0 immediately because there are a massive number of complex synchronization, GPU command quality of service and other changes conflicting with newer releases. It makes the most sense to apply the standalone security patches. Unfortunately, ARM doesn't publish the standalone security patches for the public and we need to obtain them from a vendor choosing to include and ship them since they have to publish the code.
  - ylk 4y ago
    Thanks for clarifying. My confusion stemmed from the fact that the bug is supposed to affect pixel 6 devices, which aren’t listed in the QPR2 updates but were explicitly mentioned in the update to r37p0.
    - strcat 4y ago
      We were unable to update the Pixel 6 devices to r38p1 due to more changes being required beyond the kernel driver update. The security patches were shipped regardless, and that also happened upstream for AOSP and the stock Pixel OS for the January update. All of the security fixes first shipped with QPR2 Beta 1 on December 12 which we shipped on December 14th were then shipped in the AOSP / stock Pixel OS January stable release despite it still using r36p0. The security patches are available without updating the major release, at least if you're either an ARM partner or an ARM partner has published an update with the patches and therefore released them. In our case, we can't get the standalone security patches directly from ARM but we can ship the kernel backports as soon as they're in an Android quarterly or major release beta. We can't necessarily ship the major releases of the driver just because they're in a quarterly or major release since they can depend on other changes which is what happened with the Pixel 6. It crashes without updating the userspace driver, not just the kernel driver, and updating the userspace driver seems to require other changes. It's not blocking any security patches though.
strcat 4y ago
Please see our release notes: https://grapheneos.org/releases#2022121400 https://grapheneos.org/releases#2022121400 > kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to r38p1 along with other changes included in the QPR2 Beta 1 including a bunch of security fixes previously neglected upstream (GrapheneOS will continue applying further updates downstream) Our December 14th release was the release fixing this vulnerability and a bunch of others based on the Android 13 QPR2 Beta 1 release on December 12th which included these fixes. The January release of AOSP and the stock Pixel OS also included the security patch backports without including the update to r38p1. The update to r38p1 is nice to have since it fixes more bugs than the security bugs and has other improvements, so it's nice that we were able to ship it early but it's not really a security feature. This isn't like the Linux kernel where there are an enormous number of changes and no serious attempt at determining which ones are security bugs. ARM does a good job determining which are security bugs and making security patches available separately. Unfortunately, ARM is not very friendly towards people building on their platform that are not partnered with them. They don't make the standalone security patches publicly available, even after a delay. It's possible they see making the patches available separately as helpful to attackers but that's a bit ridiculous because the code is available either way and it doesn't take long to identify the security patches which are one of the main things being done in the releases. If ARM made the standalone security patches public available, we could get them to our stable channel within days of release instead of needing to wait for their partners like Google or Samsung to do their own releases and publish the patches. It would be very helpful to us if an ARM partner collaborated with us since we would be able to ship these fixes faster. The reason we can't simply upgrade to the new major releases of the driver immediately is because there are thousands of lines of changes to the kernel driver for the Tensor SoC with many invasive optimizations switching to finer grained locking across the driver, adding quality of service for GPU commands, etc. They made substantial changes to the driver and seemingly also the firmware/hardware to an extent, although likely just in between the actual GPU and the OS where they handle IOMMU, quality of service, etc. If they had a barely modified ARM Mali GPU and driver, we could easily update to each new major release in days, but that's not the case. We could do that on another device without so many changes to the driver though. It's entirely device specific. ARM provides a base for vendors to build on and how much they optimize/improve things downstream varies a lot. Google decided to do a ton of downstream optimization for the Pixel 7 GPU. They decided to focus on the GPU with that generation and let the CPU get neglected, which they'll almost certainly fix next year. Part of the initial growing pains for Tensor has been that they released the Pixel 6 with a great CPU but weak GPU and then the Pixel 7 with a great GPU but outdated CPU. These delays with Mali patches are another example, although other Android vendors almost all did worse not better.

ylk 4y ago

as far as I can tell GrapheneOS doesn't have the patch, yet. the most recent mention on their releases page is for the 2022120300 release: > kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro): update Mali GPU driver to r37p0 (current release is r41p0 but there are substantial changes to the driver for the Tensor SoC on Pixels and it will take substantial work to upgrade all the way) https://grapheneos.org/releases#2022120300 https://grapheneos.org/releases#2022120300 from the article: > The Arm security team were very helpful throughout and released a public patch in version r40p0 of the driver on 2022-10-07 to address the issue [...]

gradeless 4y ago
The writeup of the bug states that it was patched in the January update for Pixels, which GrapheneOS has. But previous work on applying mali patches early led to GarpheneOS having a fix earlier than stock Pixels https://github.com/GrapheneOS/os-issue-tracker/issues/1914#issuecomment-1401114851 https://github.com/GrapheneOS/os-issue-tracker/issues/1914#i...
- strcat 4y ago
  Android 13 QPR2 Beta 1 came out on December 12th. This included backports of the ARM Mali GPU driver security along with a separate update to r38p1. GrapheneOS shipped these for the kernel driver. We had already done earlier work on updating the Mali GPU kernel drivers, but it's a lot more difficult for us because ARM doesn't make the standalone security patches available to the public and we don't currently have partner access to obtain them directly. We can ship them once Google or another vendor publishes the code. Generally, this will mean we can ship them once the next Android quarterly release Beta becomes available because they ship kernel patches months early in quarterly releases.
strcat 4y ago
> as far as I can tell GrapheneOS doesn't have the patch, yet. That's not correct. Android 13 QPR2 Beta 1 came out on December 12th. This included backports of the ARM Mali GPU driver security along with a separate update to r38p1. GrapheneOS shipped these for the kernel driver. > the most recent mention on their releases page is for the 2022120300 release: That's not the most recent mention on our releases page. This is the most recent relevant change: > full 2023-01-05 security patch level Here is a previous Mali GPU driver update: > kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to QPR2 Beta 2 release Here is another previous Mali GPU driver update: > kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to r38p1 along with other changes included in the QPR2 Beta 1 including a bunch of security fixes previously neglected upstream (GrapheneOS will continue applying further updates downstream) Looking at the version number is not enough. ARM makes separate security patches available to their partners. Google is primarily shipping the backported security patches and gradually upgrades the driver version. The reason for this is that there are massive changes to the Mali GPU kernel driver for the Tensor SoC GPU. This is why GrapheneOS can't simply update it to r41p0 immediately because there are a massive number of complex synchronization, GPU command quality of service and other changes conflicting with newer releases. It makes the most sense to apply the standalone security patches. Unfortunately, ARM doesn't publish the standalone security patches for the public and we need to obtain them from a vendor choosing to include and ship them since they have to publish the code.
- ylk 4y ago
  Thanks for clarifying. My confusion stemmed from the fact that the bug is supposed to affect pixel 6 devices, which aren’t listed in the QPR2 updates but were explicitly mentioned in the update to r37p0.
  - strcat 4y ago
    We were unable to update the Pixel 6 devices to r38p1 due to more changes being required beyond the kernel driver update. The security patches were shipped regardless, and that also happened upstream for AOSP and the stock Pixel OS for the January update. All of the security fixes first shipped with QPR2 Beta 1 on December 12 which we shipped on December 14th were then shipped in the AOSP / stock Pixel OS January stable release despite it still using r36p0. The security patches are available without updating the major release, at least if you're either an ARM partner or an ARM partner has published an update with the patches and therefore released them. In our case, we can't get the standalone security patches directly from ARM but we can ship the kernel backports as soon as they're in an Android quarterly or major release beta. We can't necessarily ship the major releases of the driver just because they're in a quarterly or major release since they can depend on other changes which is what happened with the Pixel 6. It crashes without updating the userspace driver, not just the kernel driver, and updating the userspace driver seems to require other changes. It's not blocking any security patches though.

strcat 4y ago

Please see our release notes: https://grapheneos.org/releases#2022121400 https://grapheneos.org/releases#2022121400 > kernel (Pixel 7, Pixel 7 Pro): update Mali GPU driver to r38p1 along with other changes included in the QPR2 Beta 1 including a bunch of security fixes previously neglected upstream (GrapheneOS will continue applying further updates downstream) Our December 14th release was the release fixing this vulnerability and a bunch of others based on the Android 13 QPR2 Beta 1 release on December 12th which included these fixes. The January release of AOSP and the stock Pixel OS also included the security patch backports without including the update to r38p1. The update to r38p1 is nice to have since it fixes more bugs than the security bugs and has other improvements, so it's nice that we were able to ship it early but it's not really a security feature. This isn't like the Linux kernel where there are an enormous number of changes and no serious attempt at determining which ones are security bugs. ARM does a good job determining which are security bugs and making security patches available separately. Unfortunately, ARM is not very friendly towards people building on their platform that are not partnered with them. They don't make the standalone security patches publicly available, even after a delay. It's possible they see making the patches available separately as helpful to attackers but that's a bit ridiculous because the code is available either way and it doesn't take long to identify the security patches which are one of the main things being done in the releases. If ARM made the standalone security patches public available, we could get them to our stable channel within days of release instead of needing to wait for their partners like Google or Samsung to do their own releases and publish the patches. It would be very helpful to us if an ARM partner collaborated with us since we would be able to ship these fixes faster. The reason we can't simply upgrade to the new major releases of the driver immediately is because there are thousands of lines of changes to the kernel driver for the Tensor SoC with many invasive optimizations switching to finer grained locking across the driver, adding quality of service for GPU commands, etc. They made substantial changes to the driver and seemingly also the firmware/hardware to an extent, although likely just in between the actual GPU and the OS where they handle IOMMU, quality of service, etc. If they had a barely modified ARM Mali GPU and driver, we could easily update to each new major release in days, but that's not the case. We could do that on another device without so many changes to the driver though. It's entirely device specific. ARM provides a base for vendors to build on and how much they optimize/improve things downstream varies a lot. Google decided to do a ton of downstream optimization for the Pixel 7 GPU. They decided to focus on the GPU with that generation and let the CPU get neglected, which they'll almost certainly fix next year. Part of the initial growing pains for Tensor has been that they released the Pixel 6 with a great CPU but weak GPU and then the Pixel 7 with a great GPU but outdated CPU. These delays with Mali patches are another example, although other Android vendors almost all did worse not better.