Google warns: Android 'patch gap' is leaving these smartphones vulnerable to attack - ZDNet

Image: MS_studio/Shutterstock

Many Android smartphones are susceptible to aggregate high-severity information issues that Google Project Zero reported implicit summertime but stay unpatched, contempt Arm releasing fixes for them. 

Android phones equipped with Arm Mali GPUs are affected by the unpatched flaws. As GPZ researcher Ian Beer points out, adjacent Google's Pixel phones are vulnerable, arsenic are phones from Samsung, Xiaomi, Oppo, and others. 

Beer is urging each large Android smartphone vendors to bash precisely what consumers get told each the time, and spot their devices arsenic soon arsenic possible. Right now, smartphone users themselves can't use a spot for an Arm Mali GPU driver, contempt Arm releasing fixes for them months ago, due to the fact that nary Android smartphone vendor has applied the fixes to their Android builds. 

As Beer notes successful a blogpost, chap GPZ researcher Jann Horn recovered 5 exploitable vulnerabilities successful the Mali GPU operator that are tracked by GPZ arsenic issues 2325, 2327, 2331, 2333, 2334. These were reported to Arm successful June and July 2022. 

Also: The champion 5G phones: Which flagship comes retired connected top?

Arm fixed them successful July and August and assigned them the vulnerability identifier CVE-2022-36449, disclosed them connected the Arm Mali Driver Vulnerabilities page, and published the patched operator root connected their nationalist developer website. Another Mali GPU bug Arm fixed is tracked arsenic CVE-2022-33917. Beers refers to some bugs successful his study astir the "patch gap" by Android telephone vendors.

So, for respective months, vendors person had the accusation disposable to spot them, but connected a caller cheque by GPZ, nary of the large Android handset brands had issued a hole for them. 

GPZ, successful enactment with its ain policies, has besides lifted its artifact connected nationalist entree to its 5 reports, which means anyone who wants to tin present person astir of the accusation they request to make exploits for the bugs, which interaction astir modern Android phones. 

Fortunately, it appears Google's Pixel squad and Android squad are connected the case. As of this week, the Android squad is talking with Android smartphone manufacturers (OEMs) and volition necessitate them to spot the vulnerabilities successful bid to comply with the Android OEM security spot level (SPL) policy. But the Pixel squad won't person patches for a fewer weeks. Other Android OEMs volition travel suit eventually.    

"Update from Android and Pixel, wrote GPZ researcher, Tim Willis, connected Tuesday successful each 5 bug reports. 

"The hole provided by Arm is presently undergoing investigating for Android and Pixel devices and volition beryllium delivered successful the coming weeks. Android OEM partners volition beryllium required to instrumentality the spot to comply with aboriginal SPL requirements," Williams wrote, quoting idiosyncratic from the Android and Pixel teams. 

For Beer, it's a reminder that vendors request to bash what consumers are told to do. 

"Just arsenic users are recommended to spot arsenic rapidly arsenic they tin erstwhile a merchandise containing information updates is available, truthful the aforesaid applies to vendors and companies," wrote Beer. 

"Minimizing the "patch gap" arsenic a vendor successful these scenarios is arguably much important, arsenic extremity users (or different vendors downstream) are blocking connected this enactment earlier they tin person the information benefits of the patch.

"Companies request to stay vigilant, travel upstream sources closely, and bash their champion to supply implicit patches to users arsenic soon arsenic possible."