The update project that should be the top priority for fixing major “zero-day vulnerabilities” to users has also encountered a situation where “non-Pixel” mobile phone users have to wait until the Android 15 major update to make up for it. Continue reading the text of the report that Google’s approach to fixing major vulnerabilities is suspected to be unique to Pixel phones and has caused controversy (other users can only wait for the Android 15 update…).
Google’s approach to fixing major vulnerabilities is suspected to be exclusive to Pixel phones, causing controversy (other users can only wait for the Android 15 update…)
I wonder if the “Pixel Feature Drop” that allows Pixel phones to be the first to use many of the latest and even exclusive new Android features, and even receive new Android major version updates super quickly, is this the main reason why everyone chooses Google’s own phone?
However, due to such differences, recently, even the update project that should be the top priority for fixing major “zero-day vulnerabilities” to users has encountered a situation where “non-Pixel” mobile phone users have to wait for the Android 15 major update much later. Not surprisingly, it sparked some discussion.
In April, the Android system vulnerability exposed by GrapheneOS and reported to Google has been basically solved in the past two regular and Pixel Feature Drop updates of Pixel phones.
Although it feels like Google has been very active in dealing with this vulnerability that is positioned as “high severity”. However, GrapheneOS pointed out that other Android brands currently have to deal with this vulnerability through annual Android Open Source Project (AOSP) updates.
Therefore, it is basically equivalent to leaving all non-Pixel mobile phone users exposed to the security crisis of the vulnerability disclosed this time before other brands are ready to update Android 15 to users.
The CVE-2024-32896 and CVE-2024-29748 vulnerabilities this time mainly correspond to the patching of vulnerabilities used by forensic companies to obtain data. These include vulnerabilities that may be exploited due to failure to clear memory in Fast boot mode, as well as an issue where AOSP’s Admin API needs to be reopened to clear it.
Although it is not clear from the description of the vulnerability how dangerous it is. However, judging from the fact that after Google releases updates for such system vulnerabilities, it is basically recommended that users update immediately. I believe that even those who do not know much about information security-related knowledge at all muggle Like us (sorry for dragging everyone down), we should all quickly understand the seriousness of this problem. You can also see why some people are worried that having to wait for the Android 15 update is an exaggeration.
After all, it doesn’t matter if you’re a Pixel phone user – because at least you’ll be able to upgrade right away. For other three-party brands, it will basically take longer because of the need to prepare customized systems and other reasons. This is certainly partly because these phone brands don’t receive quarterly or even monthly Android updates like Pixel phones.
However, some people believe that under such circumstances, methods such as backporting that can be used to patch vulnerabilities faster should be considered, so as to protect existing users from the threat of known major vulnerabilities as much as possible.
I only hope that after security experts and the media raise such concerns, Google and Android OEM brands can come up with more active correction methods as soon as possible.
Further reading:
Source: KOCPC Chinese