6 ms·

Does that mean any android app can use ndk native code execution to become root? Does selinux help here?

goodburb 2mo ago
Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely. Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way. Any compromised app on the Play store or external can get root access instantly, but we can still rely on trust and audits when installing apps which should always be the rule. I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. That's not the case with browsers with random sites and ads which is hardly avoidable, having any sandbox escape is now more severe considering that it bypasses the app container. It's similar to JailbreakMe on iOS [0] [0] https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe
- kuschku 2mo ago
  > I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity". It's silly that whenever I see a vulnerability like this, all I can think about is "finally, a way to get control over my own devices back". Once again, Stallman was right. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html Personally, I'll use this to root my Android TV and Chromecast devices and remove the shitty ads in the launcher (which Google added after I bought the devices!).
  - goodburb 2mo ago
    Agreed, but I think this will force the average user to upgrade* their phones after losing access to sensitive apps (bank, gov) before getting compromised. Good news for reusing old phones and taking control. *as in replace
    - karteum 2mo ago
      "this will force the average user to upgrade their phones" A lot of phones don't receive any upgrades after 1 or 2 years... I wish that Google would have forced vendors to implement a proper hardware abstraction (uefi or similar) so that a single kernel could run on any smartphone, just like it's the case for PCs...
      - charcircuit 2mo ago
        Google has required vendors to do that since Android 12. For a given version that same exact kernel is used on all phones with that version. https://source.android.com/docs/core/architecture/kernel/generic-kernel-image https://source.android.com/docs/core/architecture/kernel/gen...
        ChocolateGod 2mo ago
        Unfortunately it still requires OEMs to ship that kernel.
    - kuschku 2mo ago
      We should be fighting against SafetyNet and similar attestation systems. The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card, you don't need a locked down operating system. Which then allows devices to live for much longer. We're slowly losing the war on General Purpose Computing. https://media.ccc.de/v/28c3-4848-en-the_coming_war_on_general_computation https://media.ccc.de/v/28c3-4848-en-the_coming_war_on_genera...
      - ChocolateGod 2mo ago
  - didntcheck 2mo ago
    > You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Are you sure that's true? The whole reason why modern Safetynet/Play Integrity uses HSM data where possible is that you can't spoof that with root (without a microcode bug). It does not trust the running OS by design I just tried GrapheneOS's https://attestation.app/ https://attestation.app/ on a stock Pixel, and all of the OS version info shows in the "hardware verified" section
    - kuschku 2mo ago
      There's a lot of confusion around attestation, some of which is IMO done intentionally. First there is Android's attestation framework. That does actual hardware attestation, as used by GrapheneOS, and supported by literally no app whatsoever. Then there is SafetyNet, now Play Integrity. Depending on what level of integrity checking is being done, this will do a combination of cursory surface-level software checks, delegation to the aforementioned hardware attestation framework, and several other checks. Importantly, SafetyNet/Play Integrity rejects some devices that pass hardware attestation (e.g., Graphene OS), and accepts some devices that fail hardware attestation (fairphone, many cheaper devices with broken ROMs, etc). e.g., fairphone leaked the private key for their attestation, but many of their devices still pass SafetyNet, while some other devices that pass attestation but have known bootloader flaws are blocked by SafetyNet. Because this isn't strict cryptographic verification, but a mess of heuristics and guesswork, it's a constant cat and mouse game. What Google really achieved here is to make it expensive enough that no casual user can bypass it to e.g. cheat in Pokemon Go, but only a determined attacker has a chance. And with "determined attacker" I'm not just talking about states, but even e.g. movie pirates breaking DRM to rip Netflix movies. Of course, even full cryptographic attestation isn't perfect, and can be bypassed with enough effort. As shown by the famous iPhone hardware jailbreak, where you drill into the SoC and solder directly to the CPU's internal wiring.
- ChocolateGod 2mo ago
  > Considering that it's rare to get kernel (or any) updates on non-flagship phones How the cluster f*k of the Android update situation Google has allowed this to happen really needs a regulator to step in. Planned obsolescence is supposed to be illegal in Europe.
  - starfallg 2mo ago
    More to do with how the ARM ecosystem works and the resulting lack of openness and standardisation in the hardware interface.
    - ChocolateGod 2mo ago
      There's a fair amount of blame there, but it's also partially how Android has to be compiled/built for the hardware.
  - brainwad 2mo ago
    Google is the good actor here. 7 years of updates, unlocked bootloader, support for LineageOS, etc. The reason it sucks is all the other OEMs who don't care about anything other than the current year's models.
    - AnthonyMouse 2mo ago
      That's Google as the hardware OEM, not Google as the OS/platform vendor. They should be standing on Qualcomm's neck until they upstream their drivers and whatever else is necessary to make it practical for anyone to run updated kernels on their hardware, the same as it has worked for PCs for decades.
      - brainwad 2mo ago
        FWIW, when Windows NT was ported to mobile it also was compiled against binary blobs for specific Qualcomm SoCs. It's not an Android deficiency; what works on PCs just doesn't really work in mobile-land.
deleted 2mo ago
[deleted]
jeroenhd 2mo ago
selinux doesn't help when the kernel itself has been compromized like this. Sandboxes from Android and containerisation tools like Docker do not protect you against this exploit. The only feasible method of restriction is full virtualisation (assuming that if you use KVM, last week's CVE-2026-53359 patches are rolled out everywhere). Any app that can run native code execution on any version of Linux in the past fifteen years can get root until kernel updates arrive on your devices.

Considering that it's rare to get kernel (or any) updates on non-flagship phones, it seems likely. Backporting an old kernel should be possible, but the only indicator is the system update changelog that explicitly mentions it, I rarely see CVEs mentioned in changelogs on any smartphone. A tool to test the vulnerability is the only way. Any compromised app on the Play store or external can get root access instantly, but we can still rely on trust and audits when installing apps which should always be the rule. I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. That's not the case with browsers with random sites and ads which is hardly avoidable, having any sandbox escape is now more severe considering that it bypasses the app container. It's similar to JailbreakMe on iOS [0] [0] https://en.wikipedia.org/wiki/JailbreakMe https://en.wikipedia.org/wiki/JailbreakMe

kuschku 2mo ago
> I suspect that this will be added to all Google Play integrity levels, limiting many apps from being installed on unpatched phones in the future. You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Just like DRM, it gives the developer the illusion of control, but doesn't do anything to actually improve "safety" or "integrity". It's silly that whenever I see a vulnerability like this, all I can think about is "finally, a way to get control over my own devices back". Once again, Stallman was right. https://www.gnu.org/philosophy/right-to-read.en.html https://www.gnu.org/philosophy/right-to-read.en.html Personally, I'll use this to root my Android TV and Chromecast devices and remove the shitty ads in the launcher (which Google added after I bought the devices!).
- goodburb 2mo ago
  Agreed, but I think this will force the average user to upgrade* their phones after losing access to sensitive apps (bank, gov) before getting compromised. Good news for reusing old phones and taking control. *as in replace
  - karteum 2mo ago
    "this will force the average user to upgrade their phones" A lot of phones don't receive any upgrades after 1 or 2 years... I wish that Google would have forced vendors to implement a proper hardware abstraction (uefi or similar) so that a single kernel could run on any smartphone, just like it's the case for PCs...
    - charcircuit 2mo ago
      Google has required vendors to do that since Android 12. For a given version that same exact kernel is used on all phones with that version. https://source.android.com/docs/core/architecture/kernel/generic-kernel-image https://source.android.com/docs/core/architecture/kernel/gen...
      - ChocolateGod 2mo ago
        Unfortunately it still requires OEMs to ship that kernel.
  - kuschku 2mo ago
    We should be fighting against SafetyNet and similar attestation systems. The proper solution is one we had with desktop computing for decades. If you keep the key material on your eID or bank card, you don't need a locked down operating system. Which then allows devices to live for much longer. We're slowly losing the war on General Purpose Computing. https://media.ccc.de/v/28c3-4848-en-the_coming_war_on_general_computation https://media.ccc.de/v/28c3-4848-en-the_coming_war_on_genera...
    - ChocolateGod 2mo ago
- didntcheck 2mo ago
  > You do realize that a full kernel vulnerability like this allows you to feed falsified information to SafetyNet? Are you sure that's true? The whole reason why modern Safetynet/Play Integrity uses HSM data where possible is that you can't spoof that with root (without a microcode bug). It does not trust the running OS by design I just tried GrapheneOS's https://attestation.app/ https://attestation.app/ on a stock Pixel, and all of the OS version info shows in the "hardware verified" section
  - kuschku 2mo ago
    There's a lot of confusion around attestation, some of which is IMO done intentionally. First there is Android's attestation framework. That does actual hardware attestation, as used by GrapheneOS, and supported by literally no app whatsoever. Then there is SafetyNet, now Play Integrity. Depending on what level of integrity checking is being done, this will do a combination of cursory surface-level software checks, delegation to the aforementioned hardware attestation framework, and several other checks. Importantly, SafetyNet/Play Integrity rejects some devices that pass hardware attestation (e.g., Graphene OS), and accepts some devices that fail hardware attestation (fairphone, many cheaper devices with broken ROMs, etc). e.g., fairphone leaked the private key for their attestation, but many of their devices still pass SafetyNet, while some other devices that pass attestation but have known bootloader flaws are blocked by SafetyNet. Because this isn't strict cryptographic verification, but a mess of heuristics and guesswork, it's a constant cat and mouse game. What Google really achieved here is to make it expensive enough that no casual user can bypass it to e.g. cheat in Pokemon Go, but only a determined attacker has a chance. And with "determined attacker" I'm not just talking about states, but even e.g. movie pirates breaking DRM to rip Netflix movies. Of course, even full cryptographic attestation isn't perfect, and can be bypassed with enough effort. As shown by the famous iPhone hardware jailbreak, where you drill into the SoC and solder directly to the CPU's internal wiring.
ChocolateGod 2mo ago
> Considering that it's rare to get kernel (or any) updates on non-flagship phones How the cluster f*k of the Android update situation Google has allowed this to happen really needs a regulator to step in. Planned obsolescence is supposed to be illegal in Europe.
- starfallg 2mo ago
  More to do with how the ARM ecosystem works and the resulting lack of openness and standardisation in the hardware interface.
  - ChocolateGod 2mo ago
    There's a fair amount of blame there, but it's also partially how Android has to be compiled/built for the hardware.
- brainwad 2mo ago
  Google is the good actor here. 7 years of updates, unlocked bootloader, support for LineageOS, etc. The reason it sucks is all the other OEMs who don't care about anything other than the current year's models.
  - AnthonyMouse 2mo ago
    That's Google as the hardware OEM, not Google as the OS/platform vendor. They should be standing on Qualcomm's neck until they upstream their drivers and whatever else is necessary to make it practical for anyone to run updated kernels on their hardware, the same as it has worked for PCs for decades.
    - brainwad 2mo ago
      FWIW, when Windows NT was ported to mobile it also was compiled against binary blobs for specific Qualcomm SoCs. It's not an Android deficiency; what works on PCs just doesn't really work in mobile-land.

deleted 2mo ago

[deleted]

jeroenhd 2mo ago

selinux doesn't help when the kernel itself has been compromized like this. Sandboxes from Android and containerisation tools like Docker do not protect you against this exploit. The only feasible method of restriction is full virtualisation (assuming that if you use KVM, last week's CVE-2026-53359 patches are rolled out everywhere). Any app that can run native code execution on any version of Linux in the past fifteen years can get root until kernel updates arrive on your devices.