Google splats more bad Android security bugs with patches your mobe will probably never see

Good news if you've got a Nexus, otherwise you're at risk


Another month, another patching cycle for Android. Google's mobile OS has picked up seven critical patches, ten classed as high priority, and a pair of moderately important fixes.

In short, playing back a booby-trapped video or receiving a message with malware hidden in it could lead to malicious code running on a vulnerable Android device that hasn't been patched.

"We have had no reports of active customer exploitation of these newly reported issues," the March advisory states.

"Partners were notified about the issues described in the bulletin on February 1, 2016 or earlier. Source code patches for these issues will be released to the Android Open Source Project (AOSP) repository over the next 48 hours."

Most of the critical flaws were found by Google's internal security team, and nearly half deal with programming blunders in Android's Swiss-cheese-like mediaserver library, some directly and some indirectly via libvpx.

Being able to inject malware into mediaserver, via a message or video, is bad because, according to Google, "the mediaserver service has access to audio and video streams as well as access to privileges that third-party apps could not normally access."

A critical flaw in Qualcomm's implementation on Android would also lead to a permanent root that would require re-flashing the operating system to fix. The same drastic fix would also be needed if the kernel keyring component flaw isn't fixed.

Meanwhile, moves to strengthen Android against the attacks involving libstagefright only get a high severity rating, as do yet more fixes for Mediaserver. The full list of bugs – some reaching as far back as Android 4.4 as well as versions 5 and 6 – are below:

Issue CVE Severity
Remote Code Execution Vulnerability in Mediaserver CVE-2016-0815, CVE-2016-0816 Critical
Remote Code Execution Vulnerabilities in libvpx CVE-2016-1621 Critical
Elevation of Privilege in Conscrypt CVE-2016-0818 Critical
Elevation of Privilege Vulnerability in the Qualcomm Performance Component CVE-2016-0819 Critical
Elevation of Privilege Vulnerability in MediaTek Wi-Fi Driver CVE-2016-0820 Critical
Elevation of Privilege Vulnerability in Keyring Component CVE-2016-0728 Critical
Mitigation Bypass Vulnerability in the Kernel CVE-2016-0821 High
Elevation of Privilege in MediaTek Connectivity Driver CVE-2016-0822 High
Information Disclosure Vulnerability in Kernel CVE-2016-0823 High
Information Disclosure Vulnerability in libstagefright CVE-2016-0824 High
Information Disclosure Vulnerability in Widevine CVE-2016-0825 High
Elevation of Privilege Vulnerability in Mediaserver CVE-2016-0826, CVE-2016-0827 High
Information Disclosure Vulnerability in Mediaserver CVE-2016-0828, CVE-2016-0829 High
Remote Denial of Service Vulnerability in Bluetooth CVE-2016-0830 High
Information Disclosure Vulnerability in Telephony CVE-2016-0831 Moderate
Elevation of Privilege Vulnerability in Setup Wizard CVE-2016-0832 Moderate

The vast majority of Android users aren't going to be getting these updates soon enough, however. Nexus owners will get a push this week, and Samsung's better than most at pushing out fixes, but some other handset owners may carry these flaws until they upgrade their hardware.

In the meantime, the malware writers will be getting busy reverse-engineering the Android patches and designing code to exploit the flaws. In the PC sphere this can take as little as 48 hours, although for mobile it's taking a little longer. ®

Similar topics


Other stories you might like

  • Prisons transcribe private phone calls with inmates using speech-to-text AI

    Plus: A drug designed by machine learning algorithms to treat liver disease reaches human clinical trials and more

    In brief Prisons around the US are installing AI speech-to-text models to automatically transcribe conversations with inmates during their phone calls.

    A series of contracts and emails from eight different states revealed how Verus, an AI application developed by LEO Technologies and based on a speech-to-text system offered by Amazon, was used to eavesdrop on prisoners’ phone calls.

    In a sales pitch, LEO’s CEO James Sexton told officials working for a jail in Cook County, Illinois, that one of its customers in Calhoun County, Alabama, uses the software to protect prisons from getting sued, according to an investigation by the Thomson Reuters Foundation.

    Continue reading
  • Battlefield 2042: Please don't be the death knell of the franchise, please don't be the death knell of the franchise

    Another terrible launch, but DICE is already working on improvements

    The RPG Greetings, traveller, and welcome back to The Register Plays Games, our monthly gaming column. Since the last edition on New World, we hit level cap and the "endgame". Around this time, item duping exploits became rife and every attempt Amazon Games made to fix it just broke something else. The post-level 60 "watermark" system for gear drops is also infuriating and tedious, but not something we were able to address in the column. So bear these things in mind if you were ever tempted. On that note, it's time to look at another newly released shit show – Battlefield 2042.

    I wanted to love Battlefield 2042, I really did. After the bum note of the first-person shooter (FPS) franchise's return to Second World War theatres with Battlefield V (2018), I stupidly assumed the next entry from EA-owned Swedish developer DICE would be a return to form. I was wrong.

    The multiplayer military FPS market is dominated by two forces: Activision's Call of Duty (COD) series and EA's Battlefield. Fans of each franchise are loyal to the point of zealotry with little crossover between player bases. Here's where I stand: COD jumped the shark with Modern Warfare 2 in 2009. It's flip-flopped from WW2 to present-day combat and back again, tried sci-fi, and even the Battle Royale trend with the free-to-play Call of Duty: Warzone (2020), which has been thoroughly ruined by hackers and developer inaction.

    Continue reading
  • American diplomats' iPhones reportedly compromised by NSO Group intrusion software

    Reuters claims nine State Department employees outside the US had their devices hacked

    The Apple iPhones of at least nine US State Department officials were compromised by an unidentified entity using NSO Group's Pegasus spyware, according to a report published Friday by Reuters.

    NSO Group in an email to The Register said it has blocked an unnamed customers' access to its system upon receiving an inquiry about the incident but has yet to confirm whether its software was involved.

    "Once the inquiry was received, and before any investigation under our compliance policy, we have decided to immediately terminate relevant customers’ access to the system, due to the severity of the allegations," an NSO spokesperson told The Register in an email. "To this point, we haven’t received any information nor the phone numbers, nor any indication that NSO’s tools were used in this case."

    Continue reading

Biting the hand that feeds IT © 1998–2021