Project Zero - Mind the Gap
https://googleprojectzero.blogspot.com/2022/11/mind-the-gap.html
Поучительная история как минимум о двух аспектах современной индустрии:
- вендоры исправляют отрепорченные уязвимости очень "узко", не посмотрев нет ли проблемного кода вокруг:
Inspired by the description of an in-the-wild vulnerability in low-level memory management code, fellow Project Zero researcher Jann Horn started auditing the ARM Mali GPU driver. Over the next three weeks, Jann found five more exploitable vulnerabilities (2325, 2327, 2331, 2333, 2334).
One of these issues (2334) lead to kernel memory corruption, one (2331) lead to physical memory addresses being disclosed to userspace and the remaining three (2325, 2327, 2333) lead to a physical page use-after-free condition.
- производители конечных устройств просто не внедряют патчи в свои продукты:
In this case we discovered that all of our test devices which used Mali are still vulnerable to these issues. CVE-2022-36449 is not mentioned in any downstream security bulletins.
The vulnerabilities discussed in this blog post (CVE-2022-33917) are fixed by the upstream vendor, but at the time of publication, these fixes have not yet made it downstream to affected Android devices (including Pixel, Samsung, Xiaomi, Oppo and others). Devices with a Mali GPU are currently vulnerable.
Jailbreak für PS4 und PS5 schreitet voran