Attacking the Qualcomm Adreno GPU(googleprojectzero.blogspot.com) |
Attacking the Qualcomm Adreno GPU(googleprojectzero.blogspot.com) |
Deserves respect at least.
This.
Their modem code is a security nightmare and outside Qualcomms modem teams nobody is allowed to see it.
Even if one were to encrypt all connections, these will probably need to be decrypted on the GPU for processing.
Sadly todays qualcomm hardware has no real memory isolation at all - any bit of on-chip hardware can see all memory.
It isn't perfect, but it's far easier to do that than properly secure a multi-million lines of code codebase with a substantial amount of unpatchable hardware...
Qualcomm (and all Android vendors) look like they have been screwed by this. (To be clear - they are screwed because their processes are to slow to get security updates out).
I have two phones and a tablet, all mid-range devices from 3 different vendors and all are on Android 10 with at least August patches.
Edit: both phones are also more than 2 years old.
My comment referred to the timeline outlined in the post, in particular this part:
Qualcomm gives an update on the progress of a microcode based fix. The plan is that the fix will be available for OEMs by September 7, but Qualcomm will request an extension to patch integration and testing by OEMs.allow more time for patch integration and testing by OEMs.
and for their multiple subsequent requests for an extension and/or grace period.
Your August patches don't fix this - Qualcomm only notified OEMs on 4 August and their plan was to get fixes to OEMs by 7 Sep.
Yet most android devices are lucky to receive a patch within a few months... Don't worry though - that's only a window of a few months where an evil actor can drain your bank account and log your porn browsing sessions...
Unless someone is actively exploiting devices I would prefer a well tested patch to a rushed patch.
Note that this whole issue is due a previously rushed patch.
There's no real way of being sure if it is being exploited. I guess no exploits had been detected a couple of days ago, but it's not uncommon for the way it gets detected it for someone to find the exploit software somewhere. That's how Project Zero found these iOS issues for example[1].
[1] https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...
If you submit a security issue to Chrome, they actually have a tickbox on the webform to say "this issue is important enough to get someone out of bed for", and if you tick that box, it will actually wake someone at 3am to deal with it...
This itself is kind of mind boggling how they let the device overwrite its own IOMMU configuration, effectively nullifying IOMMU's purpose, and its provided safeties.
It's like fencing your house with 10 meter high walls, but leaving the key lying in front of the gate.
Three is even a hypervisor for hexagon but I don't think it is used.
I believe it can prevent the ARM core tampering with private radio hardware memory, but not the other way round.
XPUs + hypervisor should be enough, assuming Qualcomm enables them and configures them correctly.