Google says Google should do a better job of patching Android phones

Google's "Project Zero" team of security analysts wants to rid the world of zero-day security vulnerabilities, and that means it spends time calling out slacking companies on its blog. The group's latest post is a bit of friendly fire aimed at the Android and Pixel teams, which Project Zero says aren't dealing with bugs in the ARM GPU driver quickly enough.

In June, Project Zero researcher Maddie Stone detailed an in-the-wild exploit for the Pixel 6, where bugs in the ARM GPU driver could let a non-privileged user get write access to read-only memory. Another Project Zero researcher, Jann Horn, spent the next three weeks finding related vulnerabilities in the driver. The post says these bugs could allow "an attacker with native code execution in an app context [to] gain full access to the system, bypassing Android's permissions model and allowing broad access to user data."

Project Zero says it reported these issues to ARM "between June and July 2022" and that ARM fixed the issues "promptly" in July and August, issuing a security bulletin (CVE-2022-36449) and publishing fixed source code. But these actively exploited vulnerabilities haven't been patched for users. The groups dropping the ball are apparently Google and various Android OEMs, as Project Zero says that months after ARM fixed the vulnerabilities, "all of our test devices which used Mali are still vulnerable to these issues. CVE-2022-36449 is not mentioned in any downstream security bulletins."

The affected ARM GPUs include a long list of the past three generations of ARM GPU architectures (Midgard, Bifrost, and Valhall), ranging from currently shipping devices to phones from 2016. ARM's GPUs aren't used by Qualcomm chips, but Google's Tensor SoC uses ARM GPUs in the Pixel 6, 6a, and 7, and Samsung's Exynos SoC uses ARM GPUs for its midrange phones and older international flagships like the Galaxy S21 (just not the Galaxy S22). Mediatek's SoCs are all ARM GPU users, too, so we're talking about millions of vulnerable Android phones from just about every Android OEM.

In response to the Project Zero blog post, Google told Engadget, "The fix provided by Arm is currently undergoing testing for Android and Pixel devices and will be delivered in the coming weeks. Android OEM partners will be required to take the patch to comply with future SPL requirements."

The Project Zero analysts end their blog post with some advice for their colleagues, saying, "Just as users are recommended to patch as quickly as they can once a release containing security updates is available, so the same applies to vendors and companies. Minimizing the 'patch gap' as a vendor in these scenarios is arguably more important, as end users (or other vendors downstream) are blocking on this action before they can receive the security benefits of the patch. Companies need to remain vigilant, follow upstream sources closely, and do their best to provide complete patches to users as soon as possible."