Google fixes 13 Android vulnerabilities in one go, including 7 major vulnerabilities

Seven of the 13 patched security vulnerabilities are listed as "Critical", three are related to Wi-Fi drivers, and the other four are in Mediaserver, Qualcomm Performance Module and Debugger. Daemon.



Google updated the Android platform on Monday (2/1), patching 13 security vulnerabilities, including 7 major level vulnerabilities, 3 of which involved Wi-Fi capabilities, which could lead to privilege expansion or remote program attacks.

Seven of the 13 security vulnerabilities are listed as "Critical". Except for three Wi-Fi drivers, the other four exist in Mediaserver, Qualcomm Performance Module and Debugger. Daemon.

Of the three Wi-Fi-related "major" vulnerabilities, two are hidden in Broadcom's Wi-Fi driver, which may cause remote program attacks; one is Qualcomm's Wi-Fi In the driver, a vulnerability is expanded for a privilege. Although there is another privilege expansion vulnerability related to Wi-Fi functionality, its impact is not included in the "significant" risk level.

According to Google's instructions, two security vulnerabilities in Broadcom's Wi-Fi driver allow hackers to use a specially crafted wireless control message packet to destroy core memory for remote program execution when the hacker is on the same network as the victim. The vulnerability could be triggered while in the middle. The main reason for the related vulnerabilities being listed as significant risk levels is that they can execute programs remotely without user interaction.

The Qualcomm Wi-Fi driver vulnerability will allow malicious programs on the device to execute arbitrary programs in the kernel. It is a privilege expansion vulnerability and can be resident. It may be necessary to re-flash the operating system to fix the vulnerability.

Among the 13 patched vulnerabilities, Google believes that the most serious vulnerability exists in Mediaserver. Any media files such as mail, browsing or multimedia messages may cause remote program attacks. However, Google has not received an attack report related to this vulnerability so far.

Google has been the first to patch Nexus devices through automatic updates, and has released the updated Nexus firmware on the Google developer website. Builds LMY49G and Android M with Security Patch Level of February 1, 2016 versions have also been patched, as for patching The original source code will be submitted to the Android Open Source Project (AOSP) within two days.

Added "Security Patch Level" in the Android 6.0 Marshmallow version released last year to show the latest patch date. Marshmallow users can "About Phone" (About phone) See the indicator in the options).