Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

thenextweb.com

Post reply on HN
Print view View original

211–220 of 236 posts

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#211

Post by lern_too_spel »

scarface74 wrote: post #194
lern_too_spel wrote: post #166

Earlier quoted context omitted.

The Epic app installed other apps using a private Samsung API, so the apps were installed using the permissions of the Samsung Galaxy Apps Store app, which has permission to install other apps (on Samsung devices). There is nothing to stop a similar confused deputy vulnerability in the iOS App Store. The Android permission system prevents it from taking pictures or doing other things it was not granted permission to…

Except there isn’t a way for an app to download code outside of the App Store and have the executable bit set.....

There isn't a way to do that on Android either. You have to use the confused deputy to install the app.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#212

Post by fooker »

pjmlp wrote: post #188
fooker wrote: post #170

Earlier quoted context omitted.

There is no 'Linux core team'

Sure there is, the ones with commit rights to validate pull requests.

That is too large to be considered 'core' and too unstructured to be considered a 'team'.

Hence these issues, arguably.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#213

Post by scarface74 »

lern_too_spel wrote: post #211
scarface74 wrote: post #194

Earlier quoted context omitted.

Except there isn’t a way for an app to download code outside of the App Store and have the executable bit set.....

There isn't a way to do that on Android either. You have to use the confused deputy to install the app.

The installer as designed was able to download code and execute it - so there was obviously a way to do it on Android.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#214

Post by jumpingmice »

wildmusings wrote: post #125
jumpingmice wrote: post #92

Earlier quoted context omitted.

The Linux kernel is a glaring example software malfunction due to its combination of moderate defect density and incredible extent, along with a culture intolerant of competence. People who became subsystem maintainers because they happened to be hanging around a mailing list in the 90s are still gatekeepers of important subsystems despite their now-decades-long records of continuous malfeasance. Patches that demonst…

You’re wrong that no one should ever use goto. Goto is a perfectly fine control flow operator IF AND WHEN you use it in a highly structured, well-understood way. This is how systems programming is done. A “goto cleanup” section at the end of a function is the best way to do exit-on-error in C, hands down. I hate that people keep peddling this nonsense because they wrote a little C and read a headline about “goto cons…

Goto is only de rigueur in terrible languages that are unable to release function-local resources automatically. It is an intentional choice by kernel authors to ignore all progress in our field after 1988 and insist on writing everything in C. It’s not the goto statements that are the problem, rather it is the culture that necessitates them.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#215

Post by jumpingmice »

jnurmine wrote: post #208
jumpingmice wrote: post #113

Earlier quoted context omitted.

Yeah that’s the rumor but allocations of any size can fail when kmem cgroup accounting is enabled and the container is out of space.

Well, if the allocation is done with GFP_ACCOUNT bit set, i.e. kmemcg accounting enabled, isn't that the intended behaviour that the allocation can fail?

Yes that is the point. In the relatively rare case of failure this particular function uses a goto to return without releasing a held mutex. Error paths within the kernel are a rich vein of malfunction.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#216

Post by sukahiroaki »

dexen wrote: post #196
dmix wrote: post #102

Earlier quoted context omitted.

The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things. I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark an…

>The failures of the Linux core team to properly prioritize security Why even post this, when it has nothing to do the with the case GP & OP described? It's misleading at best. The failure here is in the way Google has set its Android development process. They keep a separate "stable" kernel, and manually select certain patches to backport to. In process they skip all kinds of patches - performance, features, and yes…

I think there is a lot to be said about the shortcomings of the Android world in how Linux Kernel updates are trickling down the whole foodchain (or rather: are not). BUT: This particular episode is a very bad choice for your argument. Cause in this case the bugfix in question was never ported back to any regular Linux LTS version, while it actually was cherrypicked for the Android Common Kernel (branches 3.18, 4.4 and 4.9).

Now why that fix never made it in most vendor kernels (besides a few like the one in the Pixel 3 that is based on 4.9) is a good question. But at the same time there is the reality, that everyone focusing on the upstream LTS kernel would have never gotten the fix.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#217

Post by jumpingmice »

blub wrote: post #168
catern wrote: post #132

Earlier quoted context omitted.

It's interesting that even such basic usage of binder is buggy. It's long been known that binder is horrible code, but I didn't know it was quite this bad. It's unfortunate that Google chose to use a custom IPC system, binder, for Android, instead of changing Android's design to better fit Linux. If binder was in use outside Android, I expect this bug would have been caught long ago and certainly would have been back…

Judging by how much Binder's "elegant design" of BeOS pedigree was praised, I was expecting it to be quite good. I just had a look at binder.c and the ref counting and locking in general looks like a nightmare to maintain. This reminds me of how much I hate resource management in C.

Most of the BeOS was written in C++. Nobody at Be would have tolerated the code quality you find in Linux binder.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#218

Post by jsjohnst »

panpanna wrote: post #209
jsjohnst wrote: post #201

Earlier quoted context omitted.

> Apple has started multiple keynotes by talking about Android security issues. Historically, they didn’t directly identify other vendors, but strongly implied it so it was obvious to most without directly saying names. This has changed a bit recently and I feel isn’t a good thing. > I have _never_ heard Google officially talk crap about Apple. No offense, but then you aren’t paying attention. There are examples give…

> they didn’t directly identify other vendors Who cares when they do this https://essentialapple.com/in-the-news/wwdc-2014-tim-cook-te... > examples given directly in this thread Just because someone feels this way it does not make it true. I bet apples own security team are 100% thankful for someone uncovering this.

> I bet apples own security team are 100% thankful for someone uncovering this.

That’s not my point at all with my original reply. I know first hand that some Apple security members are thankful for the work of ProjectZero. But that isn’t the point I was making or you made previously, Google “not saying anything bad about Apple” is patently false.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#219

Post by carapace »

jumpingmice wrote: post #92
typical182 wrote: post #74

To me, the biggest part of this story is: 1. Over two years ago, this was apparently detected automatically by the syzkaller kernel fuzzer, and automatically reported on its public mailing list. [1] 2. Over a year and a half ago, it was apparently fixed in the upstream kernel. [2] 3. It was apparently never merged back to various "stable" kernels, leading to the recent CVE. [3] So you might read that and think "Ok, p…

The Linux kernel is a glaring example software malfunction due to its combination of moderate defect density and incredible extent, along with a culture intolerant of competence. People who became subsystem maintainers because they happened to be hanging around a mailing list in the 90s are still gatekeepers of important subsystems despite their now-decades-long records of continuous malfeasance. Patches that demonst…

"We should look at the whole project as a cautionary tale of the kind of leveraged destruction that some programmers of modest ability but extreme confidence can wreak on our industry."

Oh man, can I put that on a t-shirt?

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#220

Post by tenebrisalietum »

cryptozeus wrote: post #67

“It’s advisable that you don’t install apps from non-trustworthy sources, ” Unpopular opinion but this is why I prefer walled garden apple for my family then alternative.

It's been a awhile since I had an Android phone but don't you have to jump through some hoops to install arbitrary .apk's from the Internet, plus understand what downloading and executing a file is (something non-technical people sometimes struggle with). It's possible on Android but not typically out of the box.
Post reply on HN