Attacking the Qualcomm Adreno GPU
googleprojectzero.blogspot.com
Attacking the Qualcomm Adreno GPU
1–10 of 23 posts
Re: Attacking the Qualcomm Adreno GPU
#2Next time Project Zero finds an iOS bug and people suggest it is a commercial hitjob, point them at this.
Qualcomm (and all Android vendors) look like they have been screwed by this. (To be clear - they are screwed because their processes are to slow to get security updates out).
Re: Attacking the Qualcomm Adreno GPU
#3Guang Gong keeps disclosing many remote Chromium/Android zero click vulns, every year, which could've earned him millions on zerodium, and even more if put to real use.
Deserves respect at least.
Re: Attacking the Qualcomm Adreno GPU
#4Next time Project Zero finds an iOS bug and people suggest it is a commercial hitjob, point them at this. Qualcomm (and all Android vendors) look like they have been screwed by this. (To be clear - they are screwed because their processes are to slow to get security updates out).
Maybe you have not used Android lately?
I have two phones and a tablet, all mid-range devices from 3 different vendors and all are on Android 10 with at least August patches.
Edit: both phones are also more than 2 years old.
Re: Attacking the Qualcomm Adreno GPU
#5At least the GPU stuff is getting some scrutiny.
Their modem code is a security nightmare and outside Qualcomms modem teams nobody is allowed to see it.
Re: Attacking the Qualcomm Adreno GPU
#6At least the GPU stuff is getting some scrutiny. Their modem code is a security nightmare and outside Qualcomms modem teams nobody is allowed to see it.
Yeah I think it is pretty nuts that people are willing to use CPUs that have those modems on the same die.
Re: Attacking the Qualcomm Adreno GPU
#7Next time Project Zero finds an iOS bug and people suggest it is a commercial hitjob, point them at this. Qualcomm (and all Android vendors) look like they have been screwed by this. (To be clear - they are screwed because their processes are to slow to get security updates out).
Maybe you have not used Android lately? I have two phones and a tablet, all mid-range devices from 3 different vendors and all are on Android 10 with at least August patches. Edit: both phones are also more than 2 years old.
I have a Pixel.
My comment referred to the timeline outlined in the post, in particular this part:
Qualcomm gives an update on the progress of a microcode based fix. The plan is that the fix will be available for OEMs by September 7, but Qualcomm will request an extension to patch integration and testing by OEMs.allow more time for patch integration and testing by OEMs.
and for their multiple subsequent requests for an extension and/or grace period.
Your August patches don't fix this - Qualcomm only notified OEMs on 4 August and their plan was to get fixes to OEMs by 7 Sep.
Re: Attacking the Qualcomm Adreno GPU
#8At least the GPU stuff is getting some scrutiny. Their modem code is a security nightmare and outside Qualcomms modem teams nobody is allowed to see it.
Yeah I think it is pretty nuts that people are willing to use CPUs that have those modems on the same die.
The simple solution is memory isolation - let the modem be as insecure as you like, but anyone who breaks into the modem can only see your network traffic (hopefully all encrypted anyway) and nothing else.
Sadly todays qualcomm hardware has no real memory isolation at all - any bit of on-chip hardware can see all memory.
It isn't perfect, but it's far easier to do that than properly secure a multi-million lines of code codebase with a substantial amount of unpatchable hardware...
Re: Attacking the Qualcomm Adreno GPU
#9Next time Project Zero finds an iOS bug and people suggest it is a commercial hitjob, point them at this. Qualcomm (and all Android vendors) look like they have been screwed by this. (To be clear - they are screwed because their processes are to slow to get security updates out).
Maybe you have not used Android lately? I have two phones and a tablet, all mid-range devices from 3 different vendors and all are on Android 10 with at least August patches. Edit: both phones are also more than 2 years old.
For comparison, Google Chrome tries to get security patches to most users within 24 hours.
Yet most android devices are lucky to receive a patch within a few months... Don't worry though - that's only a window of a few months where an evil actor can drain your bank account and log your porn browsing sessions...
Re: Attacking the Qualcomm Adreno GPU
#10Earlier quoted context omitted.
Maybe you have not used Android lately? I have two phones and a tablet, all mid-range devices from 3 different vendors and all are on Android 10 with at least August patches. Edit: both phones are also more than 2 years old.
For comparison, Google Chrome tries to get security patches to most users within 24 hours . Yet most android devices are lucky to receive a patch within a few months... Don't worry though - that's only a window of a few months where an evil actor can drain your bank account and log your porn browsing sessions...
As someone using iOS, does Chrome really update multiple times a week for security patches? Am I overestimating how often security fixes go in?