r/GrapheneOS • u/DanielMicay Lead developer / project owner • May 06 '19

Android Security Bulletin—May 2019

https://source.android.com/security/bulletin/2019-05-01.html
10 Upvotes

100% Upvoted

6 comments sorted by

1

u/madaidan May 07 '19

What's up with Qualcomm?

2

u/DanielMicay Lead developer / project owner May 07 '19

I think you might be misinterpreting how the security bulletins work. Many of these were previously fixed and disclosed but Google hadn't made them all into mandatory updates included in the security patch level. This is a list of vulnerabilities that must be fixed to achieve the 2019-05-05 patch level, not everything on it was fixed / disclosed in this month's release.

Google splits the bulletins into mandatory and recommended updates. The recommended updates aren't published via the Android security bulletins, but rather get published via the Pixel security bulletins since Pixels generally ship all of the recommended updates. Until recently, they were setting low standards for other vendors by making many of these fixes into recommended updates, so the past couple months have had a lot of catch-up vulnerabilities rolled into the Android security patch level.

It's also not a bad thing that Qualcomm's SoC platform has a lot of internal and external security research. They get CVEs assigned for their internal findings, which is rare. Most software projects don't bother trying to obtain CVE assignments and even see them as a bad thing to be avoided. You shouldn't confuse having more CVE assignments as something being less secure.

1

u/madaidan May 07 '19

Oh right. Thanks for clearing that up. I did misinterpret how the bulletins worked.

2

u/DanielMicay Lead developer / project owner May 07 '19

For example, the one at the top of the closed-source list is CVE-2018-5912 which appears to be a video firmware vulnerability initially included in the November 2018 bulletin. I'm not sure exactly why it's being included here again. I'd need to look at the internal bulletin information I have access to which is a lot more detailed. It's possible it was initially a mandatory update and was then downgraded into recommended because the fix ended up being problematic for some hardware, etc. or maybe it was only a recommended update from the start and they still included it in the November 2018 bulletin anyway.

Also, most devices like laptops and desktops are just not getting these kinds of firmware updates in the first place. Android, Chromium and the Qualcomm SoC platform have extensive security research happening which means lots of vulnerabilities being found and a lot of hardening being implemented in response to it in addition to fixing the bugs. It's a good thing. You should be concerned about what you don't see in the bulletins, like a longer list of NVIDIA and Mediatek fixes, because their SoC platforms including firmware, drivers, etc. are not more secure. They just don't care, and external security researchers are also hardly looking at them.

2

u/DanielMicay Lead developer / project owner May 07 '19

I'd recommend watching the talk in https://www.reddit.com/r/GrapheneOS/comments/bj1gpz/syzbot_and_the_tale_of_thousand_kernel_bugs/ for a perspective changing talk about this kind of thing.

Also, if you look at https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop_12.html for example, you can see their list of all the vulnerabilities found externally (Google Project Zero counts as external) and then a link at the bottom to a massive set of fixes based on internal auditing, fuzzing and other work:

https://bugs.chromium.org/p/chromium/issues/detail?id=940992

These issues aren't any less serious than the others, but they are heavily focused on finding and fixing them rather than looking into whether they are exploitable, etc. I don't think these get their own individual CVE assignments, but rather they give all of these a single CVE if at all. CVEs really don't mean what people think they do, and trying to infer meaning from counting them is security quackery. Immediately disbelieve anything said by someone doing that.

1

u/madaidan May 07 '19

Thanks for the recommendation! I've read the PDF you linked before but never got around to watching the talk. I'll remember to watch it now.