4 ms·

Google ended security updates for the Pixel 4a in August 2023, so running this as your daily driver was already problematic. Fortunately, LineageOS officially s

by deng 2y ago

Google ended security updates for the Pixel 4a in August 2023, so running this as your daily driver was already problematic. Fortunately, LineageOS officially supports the 4a, and v22 (aka Android 15) was just released for it.

red_trumpet 2y ago
That point is so weird: Why offer a "performance update" 1.5 years after the end of security updates?
- bdndndndbve 2y ago
  Given the sudden urgency and pulling the old software, I'm assuming they're trying to avoid aging batteries exploding.
  - patall 2y ago
    But then they should indicate that. Which they don't.
    - ikiris 2y ago
      They did as much as they would.
alistairSH 2y ago
Isn't that just 3 years after release? Is that normal for Google phones? Yikes.
- mananaysiempre 2y ago
  For older Google phones (as well as most other Android ones) it is the standard. (AFAIU this was mostly due to Qualcomm’s policies and lack of pushback from Google et al.) Newer Google ones get 5–7 years[1], and Samsung has also switched to a similar support term (but keep in mind that only Samsung’s flagships get monthly security updates). [1] https://support.google.com/pixelphone/answer/4457705 https://support.google.com/pixelphone/answer/4457705
ndriscoll 2y ago
This attitude (and the word "problematic") is so tiring. What is the actual problem with running it as your daily driver? What specific vulnerability are you actually concerned about? Unless there's something like an arbitrary code execution bug in one of the networking/radio stacks, "there aren't updates" is a statement with approximately zero useful information.
- deng 2y ago
  OK, let me google it for you: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-43096 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-43096 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43770 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4377... https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43771 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4377... https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49747 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49747 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49748 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49748 These are just the RCE bugs without user interaction that were fixed with the January update. They are in the Bluetooth stack.
  - chasil 2y ago
    Just curious, does current LineageOS close these CVEs? I know they pull firmware from disparate devices when possible.
    - deng 2y ago
      I didn't check each one explicitly, but it looks promising https://review.lineageos.org/q/gatt_sr.cc https://review.lineageos.org/q/gatt_sr.cc
  - ndriscoll 2y ago
    So I'm not terribly familiar with Bluetooth. Are these something that can be exploited by an unpaired device? "Google Android on a Pixel 4a is vulnerable to remote code execution by arbitrary nearby wireless devices" is certainly a better reason to not use one than "security updates have ended".

by deng 2y ago

red_trumpet 2y ago

That point is so weird: Why offer a "performance update" 1.5 years after the end of security updates?

bdndndndbve 2y ago
Given the sudden urgency and pulling the old software, I'm assuming they're trying to avoid aging batteries exploding.
- patall 2y ago
  But then they should indicate that. Which they don't.
  - ikiris 2y ago
    They did as much as they would.

alistairSH 2y ago

Isn't that just 3 years after release? Is that normal for Google phones? Yikes.

mananaysiempre 2y ago
For older Google phones (as well as most other Android ones) it is the standard. (AFAIU this was mostly due to Qualcomm’s policies and lack of pushback from Google et al.) Newer Google ones get 5–7 years[1], and Samsung has also switched to a similar support term (but keep in mind that only Samsung’s flagships get monthly security updates). [1] https://support.google.com/pixelphone/answer/4457705 https://support.google.com/pixelphone/answer/4457705

ndriscoll 2y ago

This attitude (and the word "problematic") is so tiring. What is the actual problem with running it as your daily driver? What specific vulnerability are you actually concerned about? Unless there's something like an arbitrary code execution bug in one of the networking/radio stacks, "there aren't updates" is a statement with approximately zero useful information.

deng 2y ago
OK, let me google it for you: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-43096 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-43096 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43770 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4377... https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-43771 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-4377... https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49747 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49747 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49748 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-49748 These are just the RCE bugs without user interaction that were fixed with the January update. They are in the Bluetooth stack.
- chasil 2y ago
  Just curious, does current LineageOS close these CVEs? I know they pull firmware from disparate devices when possible.
  - deng 2y ago
    I didn't check each one explicitly, but it looks promising https://review.lineageos.org/q/gatt_sr.cc https://review.lineageos.org/q/gatt_sr.cc
- ndriscoll 2y ago
  So I'm not terribly familiar with Bluetooth. Are these something that can be exploited by an unpaired device? "Google Android on a Pixel 4a is vulnerable to remote code execution by arbitrary nearby wireless devices" is certainly a better reason to not use one than "security updates have ended".