Linux users already got a fix for “Dirty Cow.” Android users aren’t so fortunate. Android users waiting for a fix for a newly discovered flaw that allows apps to bypass key operating-system security protections will have to wait at least another month. The just released patch batch for November, inexplicably, won’t include it.
The so-called escalation-of-privilege vulnerability, dubbed Dirty Cow, was introduced into the core of the Linux kernel in 2007, shortly before Google engineers incorporated the open source operating system into Android. That means the bug, formally indexed as CVE-2016-5195, affects every version of Android since its inception. The flaw remained hidden from public view until October 19, when it was disclosed under a coordinated release that was designed to ensure a fix was ready before most people knew about it. The Android Security Bulletin scheduled to be automatically pushed to select handsets sometime this month, however, won’t fix the flaw.
“It’s a pretty big deal because it’s very easy to exploit,” Daniel Micay, a developer of the Android-based CopperheadOS for mobile phones, told Ars. “Unlike a memory corruption bug, there are not really any mitigations for it. [Google] can’t claim that mitigations stand in the way of easy exploitation for this bug (that’s a dubious claim when they do make it, but for this they can’t do it).”
The vulnerability is already being exploited maliciously in the wild against Linux servers so that untrusted users can gain unfettered “root” privileges. Attackers are also combining the exploit with attacks that trigger separate Linux vulnerabilities to make them much more potent than they’d otherwise be. Micay said Dirty Cow—so named because the underlying race condition bug resides in a memory management technique known as copy on write—is being actively used by Android users who want to root their phones so they bypass limitations imposed by manufacturers and carriers. He said it’s also possible exploits are being surreptitiously folded into malicious apps so that they can circumvent application sandboxing and similar Android security protections.
If some malicious rooting apps manage to sneak their way into the official Google Play app bazaar, it wouldn’t be the first time. In January, researchers found 13 Google Play apps that surreptitiously exploited rooting vulnerabilities. One of the apps was downloaded more than 1 million times before Google removed it. Another batch of malicious Google Play apps reported in June had the ability to root virtually any device running Android 5.1 or earlier, which at the time accounted for 90 percent of the Android user base.
Among the fixes announced in the November security bulletin is one for yet another Stagefright-style vulnerability in an Android component known as mediaserver. Rated critical, it allows attackers to remotely execute malicious code. A separate critical vulnerability fixed this month in the libzipfile component allows for escalation of privileges. A Google spokesman told Ars the Dirty Cow patch will be released in December. As is the case with all security fixes Google releases for Android, it will be available only for Nexus devices and a small list of other qualifying handsets. The spokesman didn’t say why the Dirty Cow patch wasn’t included in the patch bundle being released this month.
Update: As Hiroshi Lockheimer, SVP of Android, Chrome OS, and Google Play, explained in last month’s interview with Ars Reviews Editor Ron Amadeo, monthly Android security patches are released a month after they have been made available to manufacturers.
“The patches go out to the partners first, and then a month later they’ll show up on the Nexus devices,” Lockheimer said. OEMs “can, at the same time, roll out their patches as well.”
Source:https://arstechnica.com
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
