this is a feature and not a bug
Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
111–120 of 236 posts
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#112Earlier quoted context omitted.
Android has one of the best security models and sandboxing for apps. It's based around SELinux.
> Android has one of the best security models and sandboxing for apps. It's based around SELinux. You mean a security model that misses the fact that the kernel cannot be updated and relies on a "sanboxing" solution that doesn't bother limiting kernel attack surface. No, I don't think they even had a security model in mind, a threat model or anything beyond random ad hoc ideas. And if they did some thinking, they wou…
SELinux actually does significantly reduce the kernel attack surface on Android, and it has made a lot of kernel vulnerabilites unexploitable on Android. This particular bug was simply one in the remaining attack surface.
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#113Earlier quoted context omitted.
The Linux kernel is a glaring example software malfunction due to its combination of moderate defect density and incredible extent, along with a culture intolerant of competence. People who became subsystem maintainers because they happened to be hanging around a mailing list in the 90s are still gatekeepers of important subsystems despite their now-decades-long records of continuous malfeasance. Patches that demonst…
it's fairly well known that small kmallocs do not fail, and that there are many, many instances in the filesystem code which assume that small kmallocs do not fail. there have been two LWN articles on this exact subject.
Yeah that’s the rumor but allocations of any size can fail when kmem cgroup accounting is enabled and the container is out of space.
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#114Earlier quoted context omitted.
it's fairly well known that small kmallocs do not fail, and that there are many, many instances in the filesystem code which assume that small kmallocs do not fail. there have been two LWN articles on this exact subject.
And goto being used for error handling is pretty stock standard across most C codebases I’ve worked on or seen over the years, so I’m not sure what the particular gripe is there
Since when is "we do it all the time" the same as "it's a good thing"?
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#115To me, the biggest part of this story is: 1. Over two years ago, this was apparently detected automatically by the syzkaller kernel fuzzer, and automatically reported on its public mailing list. [1] 2. Over a year and a half ago, it was apparently fixed in the upstream kernel. [2] 3. It was apparently never merged back to various "stable" kernels, leading to the recent CVE. [3] So you might read that and think "Ok, p…
The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things. I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark an…
GRSec is the primary reason the Android devices from BlackBerry have never, to my knowledge, been rooted (despite their many flaws). It's crazy that it's not more accepted.
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#116> It’s advisable that you don’t install apps from non-trustworthy sources, and use an alternate browser such as Firefox or Brave till the issue is fixed. We’ll keep you posted on any updates issued by phone makers.
The recommendation that other browsers are inherently protected doesn’t make sense. Any app with an rce bug could be a vehicle to exploit this Android bug.
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#117This is another great chance to root your phone and take complete control of what you should rightly own.
More things to exploit as well.
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#118Oppo A3, but not OnePlus 7 pro?
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#119this is a feature and not a bug
Do you have a source for that?
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#120Earlier quoted context omitted.
The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things. I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark an…
GRSec is the primary reason the Android devices from BlackBerry have never, to my knowledge, been rooted (despite their many flaws). It's crazy that it's not more accepted.
I personally wouldn't trust a company that openly bragged it built a system to provide local police and Intel agencies with real time access to Blackberry messaging flowing across an entire city in 2010 for G20. In addition to sharing their "master" encryption key for a number of years:
https://www.theverge.com/2016/4/14/11434926/blackberry-encry...
Also AFAIK Blackberry only provided a hardened kernel with a single device in 2015 called Priv. I haven't heard anything from them since... maybe someone could correct me here.