Nougat (7.0)
Marshmallow (6.0)
Take Nexus 5.
Opens Settings, Device information.
Android Version: 6.0.1. Great.
Android Security Level: 2016-10-5. A year old. Great.
Tap System update, force check... no update. Great.
Thank you Google.
Why is the title singling out Linux? Reading through the rest of it, it seems like this is on pretty much everything.
For some reason, this vuln was not promptly disclosed to the Kernel security team. From the article:
Google – Contacted on April 19, 2017
Microsoft – Contacted on April 19, 2017
Apple – Contacted on August 9, 2017
Linux – Contacted August 15 and 17, 2017
Samsung – Contact on three separate occasions in April, May, and June. No response was received back from any outreach.While I totally believe that my device will receive a patch at some point in time, the majority of devices out there will probably never receive the patch Google provided. And even this recent phone is now vulnerable to a vulnerability that was just disclosed to the public at large..
I'd say Android is pretty much in deep (or rather: deeper than usual) shit as well, not just Linux
> Microsoft is issuing security patches to all supported Windows versions at 10 AM, Tuesday, September 12.
> Information on Linux updates will be provided as soon as they are live.
> All iPhone, iPad and iPod touch devices with iOS 9.3.5 and lower, and AppleTV devices with version 7.2.2 and lower are affected by the remote code execution vulnerability. This vulnerability was already mitigated by Apple in iOS 10, so no new patch is needed to mitigate it. We recommend you upgrade to the latest iOS or tvOS available.
This one will get nasty...
They state 10% of all Android devices are vulnerable and won't get patches, and since the vulnearbility is arguably wormable I can't see how these devices will stay clean.
I'm more worried about higher value targets like cars and things like lightbulbs that never get updated. This could be an amazing wormable bug.
> Despite this, the Linux Kernel is lagging behind in implementing some modern mitigations in its default configuration. Both stack canaries - which protect against stack overflows, and KASLR (kernel address space layout randomization) are lacking in most devices running Linux today
It seems that they opted not to try to bypass stack canaries, probably because of the number of Android devices running old versions of Linux.
It seems inaccurate for them to categorize this as a problem with kernel itself, however. The kernel itself isn't "lagging behind" if mobile/embedded devices won't update to never versions containing newer mitigation techniques.
I wonder whether it is still worth investigating?