{"id":19391,"date":"2022-11-28T20:21:54","date_gmt":"2022-11-28T20:21:54","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/11\/28\/old-zero-day-vulnerabilities-remain-unpatched-on-samsung-google-phones\/"},"modified":"2022-11-28T20:21:54","modified_gmt":"2022-11-28T20:21:54","slug":"old-zero-day-vulnerabilities-remain-unpatched-on-samsung-google-phones","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/11\/28\/old-zero-day-vulnerabilities-remain-unpatched-on-samsung-google-phones\/","title":{"rendered":"Old Zero-Day Vulnerabilities Remain Unpatched on Samsung, Google Phones"},"content":{"rendered":"

<\/a>\n<\/p>\n

This site may earn affiliate commissions from the links on this page. Terms of use<\/a>.<\/div>\n
\n
\n
\n\"\" <\/div>\n<\/div>\n

Google\u2019s Project Zero team is on the front lines of digital security, analyzing code, reporting bugs, and generally making the internet safer. However, not every vulnerability gets fixed in a timely manner. A recent batch of serious flaws in Arm\u2019s Mali GPU were reported by Project Zero and fixed by the manufacturer. However, smartphone vendors never implemented the patches, among them Google itself. So, that\u2019s a little embarrassing.<\/p>\n

The story starts in June 2022 when Project Zero researcher Maddie Stone gave a presentation<\/a> on zero-day exploits \u2014 known vulnerabilities for which there is no available patch. The talk used a vulnerability identified as CVE-2021-39793 and the Pixel 6 as an example. This flaw allowed apps to access read-only memory pages, which can leak personal data. Following this, researcher Jann Horn started looking more closely at ARM Mali GPU code, finding five more vulnerabilities<\/a> that could allow an attacker to bypass Android\u2019s permission model and take control of the system.<\/p>\n

Some of these issues were allegedly available for sale on hacking forums, making them especially important to patch. Project Zero reported the issues to ARM, which followed up with source code patches for vendors to implement. Project Zero waited another 30 days to disclose the flaws, which it did in August and mid-September 2022. Usually, this would be the end of the story, but Project Zero occasionally circles back to assess the functionality of fixes. In this case, the team found a \u201cpatch gap.\u201d<\/p>\n

\"\"<\/p>\n

Google believes the Mali issues it uncovered were already available in the zero-day market.<\/p>\n<\/div>\n

Although ARM released the patches over the summer, vendors hadn\u2019t integrated them into their regular Android updates<\/a>. The issues affect numerous devices that run a system-on-a-chip featuring a Mali GPU, including Android phones from Samsung, Xiaomi, Oppo, and Google. Snapdragon chips are spared as they use Qualcomm\u2019s own Adreno GPU. So, Samsung phones in North America are safe, but those sold internationally with Exynos chips are at risk.<\/p>\n

In past years, this might not have affected Google, but the company switched from Qualcomm to the custom Tensor chips for Pixel phones in 2021<\/a>. Tensor uses a Mali GPU, so Google\u2019s security team found flaws that the Pixel team failed to add to the regular software updates. Google is not alone in making this mistake, but it\u2019s still not a great look. Google now says that the Mali patches will be added to Pixel phones \u201cin the coming weeks.\u201d Other vendors haven\u2019t offered a timetable yet.<\/p>\n

Now read: <\/strong><\/p>\n<\/p><\/div>\n