Google has discovered an Android vulnerability that has left millions of devices vulnerable to risk. The vulnerability was discovered by Google’s Project Zero team composed of security analysts. The unpatched vulnerability, known as CVE-2022-33917 (Common Vulnerabilities and Exposures), affects Android devices running ARM’s Mali GPU. This includes a number of devices from different manufacturers like Samsung and Google.
This was reported by 9to5Google, which detailed that the vulnerability was actually discovered in June and July. ARM already fixed the Mali GPU issue a while back but several Android devices did not implement the fixes yet, which left the vulnerability open. And once exploited, attackers could “read and write physical pages after they had been returned to the system.” This left users at risk for getting their data stolen.
Google’s Project Zero said:
We reported these five issues to ARM when they were discovered between June and July 2022. ARM fixed the issues promptly in July and August 2022, disclosing them as security issues on their Arm Mali Driver Vulnerabilities page (assigning CVE-2022-36449) and publishing the patched driver source on their public developer website.
…we discovered that all of our test devices which used Mali are still vulnerable to these issues. CVE-2022-36449 is not mentioned in any downstream security bulletins.
The vulnerability does not affect devices that are using Qualcomm Snapdragon chips since they are not equipped with ARM’s Mali GPU. The ones that are affected are the devices that operate on MediaTek, Samsung Exynos, and Google Tensor chips.
Google has released a statement promising that they are currently testing a fix for the exploit, which will be delivered in the “coming weeks.” Android partners will be required to use the patch.
Source: 9to5Google
