{"id":103328,"date":"2022-02-14T09:36:44","date_gmt":"2022-02-14T07:36:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/oczenka-operativnosti-ustraneniya-uyazvimostej-obnaruzhennyh-google-project-zero"},"modified":"2022-02-14T09:36:44","modified_gmt":"2022-02-14T07:36:44","slug":"oczenka-operativnosti-ustraneniya-uyazvimostej-obnaruzhennyh-google-project-zero","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/oczenka-operativnosti-ustraneniya-uyazvimostej-obnaruzhennyh-google-project-zero","title":{"rendered":"Assessment of the responsiveness in addressing vulnerabilities discovered by Google Project Zero","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Researchers from the Google Project Zero team summarized data on the response times of manufacturers to newly discovered vulnerabilities in their products. According to Google's policy, manufacturers have 90 days to address vulnerabilities identified by Google Project Zero researchers, with an additional public disclosure potentially delayed by another 14 days upon separate request. After 104 days, details about the vulnerability are disclosed even if the issue remains unresolved. <\/p>\n
From 2019 to 2021, the project identified 376 issues, of which 351 (93.4%) were resolved. 11 (2.9%) vulnerabilities remained unaddressed, and another 14 (3.7%) problems were marked as WontFix. Over the years, there has been a decline in the number of vulnerabilities for which fixes were not delivered within the designated timeframe \u2014 in 2021, an additional 14 days were requested for 14% of the issues, and only one vulnerability was left unaddressed by the time of disclosure.
<\/p>\n
Manufacturer<\/p>\n
Number of Issues<\/p>\n
Fixed within 90 days<\/p>\n
Fixed within additional 14 days<\/p>\n
Not fixed within the allocated time <\/p>\n
Average number of days to fix<\/p>\n
Apple<\/p>\n
84<\/p>\n
73 (87%)<\/p>\n
7 (8%)<\/p>\n
4 (5%)<\/p>\n
69<\/p>\n
by Microsoft<\/p>\n
80<\/p>\n
61 (76%)<\/p>\n
15 (19%)<\/p>\n
4 (5%)<\/p>\n
83<\/p>\n
Google<\/p>\n
56<\/p>\n
53 (95%)<\/p>\n
2 (4%)<\/p>\n
1 (2%)<\/p>\n
44<\/p>\n
Linux<\/p>\n
25<\/p>\n
24 (96%)<\/p>\n
0 (0%)<\/p>\n
1 (4%)<\/p>\n
25<\/p>\n
Adobe<\/p>\n
19<\/p>\n
15 (79%)<\/p>\n
4 (21%)<\/p>\n
0 (0%)<\/p>\n
65<\/p>\n
Mozilla<\/p>\n
10<\/p>\n
9 (90%)<\/p>\n
1 (10%)<\/p>\n
0 (0%)<\/p>\n
46<\/p>\n
Samsung<\/p>\n
10<\/p>\n
8 (80%)<\/p>\n
2 (20%)<\/p>\n
0 (0%)<\/p>\n
72<\/p>\n
Oracle<\/p>\n
7<\/p>\n
3 (43%)<\/p>\n
0 (0%)<\/p>\n
4 (57%)<\/p>\n
109<\/p>\n
Others*<\/p>\n
55<\/p>\n
48 (87%)<\/p>\n
3 (5%)<\/p>\n
4 (7%)<\/p>\n
44<\/p>\n
TOTAL<\/p>\n
346<\/p>\n
294 (84%)<\/p>\n
34 (10%)<\/p>\n
18 (5%)<\/p>\n
61<\/p>\n
<\/center> <\/p>\n
On average, it took 52 days to produce a vulnerability fix in 2021, 54 days in 2020, 67 days in 2019, and 80 in 2018. The vulnerabilities were addressed most quickly in the Linux kernel \u2014 averaging 15, 22, and 32 days in 2021, 2020, and 2019, respectively. Microsoft had the slowest response, with an average of 76, 87, and 85 days for fixes (Oracle was even slower, taking 109 days on average to respond). Apple took an average of 64, 63, and 71 days for fixes. In Google products, the average time to generate fixes over the years was 53, 22, and 49 days.
<\/p>\n
Vendor<\/p>\n
Bugs in 2019<\/p>\n
(avg days to fix)<\/p>\n
Bugs in 2020<\/p>\n
(avg days to fix)<\/p>\n
Bugs in 2021<\/p>\n
(avg days to fix)<\/p>\n
Apple<\/p>\n
61 (71)<\/p>\n
13 (63)<\/p>\n
11 (64)<\/p>\n
by Microsoft<\/p>\n
46 (85)<\/p>\n
18 (87)<\/p>\n
16 (76)<\/p>\n
Google<\/p>\n
26 (49)<\/p>\n
13 (22)<\/p>\n
17 (53)<\/p>\n
Linux<\/p>\n
12 (32)<\/p>\n
8 (22)<\/p>\n
5 (15)<\/p>\n
Others*<\/p>\n
54 (63)<\/p>\n
35 (54)<\/p>\n
14 (29)<\/p>\n
TOTAL<\/p>\n
199 (67)<\/p>\n
87 (54)<\/p>\n
63 (52)<\/p>\n
<\/center> <\/p>\n
Among browser manufacturers, Chrome has the most timely fixes, yet Firefox releases patches faster after the fix appears (in Chrome and Safari, vulnerabilities fixed in code remain unaddressed for users for a significant period, which is exploited by attackers).
Browser Number of IssuesAverage days from notification of the issue to patch publicationAverage time from patch publication to product releaseAverage time from vulnerability notification to release with fix <\/p>\n