TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Driving forward in Android drivers

103 点作者 idiocrat11 个月前

5 条评论

mschuster9111 个月前
&gt; However, based on open-source codebases for these different devices&#x27; kernels, it appears MediaTek is actively maintaining several different trees for this driver, likely based on the associated kernel version, and these two devices use separate trees.<p>This one sentence just perfectly sums up everything that&#x27;s broken in the embedded (i.e. everything non-x86) world. Everyone just forks random stuff at random points in the BSP&#x27;s life time, and <i>no one</i> makes even the slightest effort to upstream it to mainline Linux (if that&#x27;s possible at all given that Android&#x27;s Linux fork itself does a lot of things differently than Linux upstream likes).<p>&gt; I found two vulnerabilities in this driver. CVE-2023-32837 was a textbook OOB read&#x2F;write in an array of structs. Various different members of the struct were accessed and modified, creating several different possibilities for exploitation, but also making them significantly more challenging. Interestingly, MediaTek partially fixed this bug in July 2021, although the exact date this patch went out to OEMs is unclear.<p>And that&#x27;s the second point of danger. All the forks floating around make distributing patches in an efficient way all but impossible.<p>The fact that it&#x27;s <i>Google</i> complaining here makes it all the more hilarious IMHO. Google are the ones who could fix this in an instant: demand upstreaming (or at least, reasonable efforts towards that) as a part of getting the Play Store certification.<p>A side note towards root exploit hunters: MediaTek&#x27;s stuff is particularly gory. I&#x27;ll admit my knowledge is some years dated, but I can&#x27;t imagine that their code style and code quality has improved over the time...
评论 #40686620 未加载
salesynerd11 个月前
I&#x27;m not a security professional but I have been reading about Google Project Zero&#x27;s research for quite some time and I have massive respect for the team as well as Google for the work they do.
评论 #40680399 未加载
JosephRedfern11 个月前
I remember some crazy insecure drivers on Android drivers back in the day (2012-13 or so) -- stuff like `&#x2F;dev&#x2F;fbN` and `&#x2F;dev&#x2F;input&#x2F;eventN` being world read&#x2F;writeable, allowing unprivileged screen and input capture from any application.<p>It was far more basic than what&#x27;s described in this blog post, but really good fun to poke around at.
yjftsjthsd-h11 个月前
&gt; Shortening this propagation delay (e.g. using Android APEX to ship updated kernel drivers) would go a long way to minimizing the Android driver patch gap.<p>Oh, I didn&#x27;t realize APEX could ship kernel modules; that&#x27;s neat.
评论 #40686582 未加载
neogodless11 个月前
Posted less than 24 hours ago (but likely not front page &#x2F; no comments)<p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40673155">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=40673155</a>