Mobile phones running Android 12 are at risk after the discovery of a vulnerability in the Linux kernel called “Dirty Pipe” that also affects flagship phones such as the Pixel 6 series and potentially the Galaxy S22 series as well.
The issue is impacting newer devices on Android 12 as reports have suggested users to update to the latest version of the software, including the security updates, which are release every month.
Although, it is not yet confirmed if Google’s latest security update fixes the flaw.
The vulnerability leads to malicious applications and software gaining root-level access to the device and uses it to overwrite data on protected read-only files.
How Dirty Pipe flaw was found?
The vulnerability was named after “Dirty Cow”, a similar ‘privilege-escalation’ vulnerability that was discovered and fixed in 2016. Privilege escalation is when unauthorised applications and processes can gain access to a system by exploiting a vulnerability. The “pipe” part of the vulnerability’s nomenclature comes from the fact that it exploits pipes, which are tools used by Linux system processes to communicate with each other. Dirty Pipe is reportedly easier to exploit than Dirty Cow.
Max Kellerman, a security researcher at German web development and hosting company CM4all, initially discovered the vulnerability a year ago when one of the company’s clients raised a support ticket after finding a corrupt file on their system.
The researcher discovered the flaw in the course of his research on what caused this file corruption. He was eventually able to reproduce the error on the Google Pixel 6 and sent a bug report to the Android Security Team.
Read More: WINDOWS 11: KNOW HOW TO INSTALL ANDROID APPS
He also sent a patch to LKML (Linux Kernel mailing list) after being advised to do so by multiple developers including Linus Torvalds, the creator of the Linux kernel. Meanwhile, according to Ars Technica’s RonAmadeo, the bug likes impacts the Galaxy S22 series as well, given it is on the Linux 5.8 kernel which is impacted. Samsung has not yet commented on the issue.
from Science and Technology News - Latest science and technology news https://ift.tt/GitQbZJ
via IFTTT