Android 13 Preview. Android 12 Remote Vulnerability

Google has introduced the first test version of the open mobile platform Android 13. Android 13 is expected to be released in the third quarter of 2022. To evaluate the new features of the platform, a preliminary testing program has been proposed. Firmware builds are prepared for Pixel 6/6 Pro, Pixel 5/5a, Pixel 4 / 4 XL / 4a / 4a (5G) devices.

Key innovations in Android 13:

  • A system interface for selecting photos and videos has been implemented, as well as an API for selectively granting application access to selected files. It is possible to work both with local files and with data hosted in cloud storages. A feature of the interface is that it allows you to provide access to individual images and videos without giving the application full access to view all media files in the storage. Previously, a similar interface was implemented for documents.
    Android 13 Preview. Android 12 Remote Vulnerability
  • Added a new Wi-Fi permission type that allows applications that search for wireless networks and connect to hotspots the ability to access a subset of the Wi-Fi management APIs, excluding location-based calls (previously applications that connect to Wi-Fi , and accessed location information).
  • Added an API for placing buttons in the quick settings section at the top of the notification dropdown. Using this API, an application can issue a request to place its button with a quick action, allowing the user to add a button without leaving the application and without separately going to the settings.
    Android 13 Preview. Android 12 Remote Vulnerability
  • Provided the ability to adapt the background of the icons of any applications to the color scheme of the theme or the color of the background image.
    Android 13 Preview. Android 12 Remote Vulnerability
  • Added the ability to bind individual language settings to applications that differ from the language settings selected in the system.
  • The word wrap operation has been optimized (breaking words that do not fit into the line using a hyphen). In the new version, transfer performance has been increased by 200% and now has almost no effect on rendering speed.
  • Added support for programmable graphics shaders (RuntimeShader objects) defined in Android Graphics Shading Language (AGSL), which is a subset of GLSL adapted for use with the Android rendering engine. Similar shaders are already used in the Android platform itself to implement various visual effects, such as pulsing, blurring, and stretching when scrolling past the page boundary. Similar effects can now be created in applications.
  • The core Java libraries of the platform and application development tools have been updated to OpenJDK 11. The update is also available through Google Play for devices based on Android 12.
  • As part of the Mainline project, which allows updating individual system components without updating the entire platform, new upgradable system modules have been prepared. The updates affect non-hardware components that are downloaded through Google Play separately from OTA firmware updates from the manufacturer. Among the new modules that can be updated via Google Play without updating the firmware are Bluetooth and Ultra wideband. Modules with Photo picker and OpenJDK 11 are also distributed through Google Play.
  • Improvements have been made to building app interfaces for larger screens on tablets, multi-screen foldables, and Chromebooks.
  • Simplified testing and debugging of new platform features. Changes can now be selectively enabled for applications in the developer options section or through the adb utility.
    Android 13 Preview. Android 12 Remote Vulnerability

Additionally, the February Android Security Patch is published, which fixes 37 vulnerabilities, of which 2 vulnerabilities are rated Critical and the rest are rated High. Critical problems allow you to make a remote attack to execute your code on the system. Issues marked as dangerous allow code to be executed in the context of a privileged process through manipulation of local applications.

The first critical vulnerability (CVE-2021-39675) is caused by a buffer overflow in the GKI_getbuf (Generic Kernel Image) function and allows remote access to the system without any user action. Details about the vulnerability have not yet been disclosed, but it is known that the problem affects only the Android 12 branch. The second critical vulnerability (CVE-2021-30317) is present in closed components for Qualcomm chips.

Source: opennet.ru

Add a comment