Recently there has been the discovery of the Dirty Cow bug in the linux kernel which allows the unlogged access to superuser privileges:
Dirty Cow CVE-2016-5195 (from https://dirtycow.ninja/) :
Why is it called the Dirty COW bug?
"A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only memory mappings. An unprivileged local user could use this flaw to gain write access to otherwise read-only memory mappings and thus increase their privileges on the system."
The Guardian - 'Dirty Cow' Linux vulnerability found after 9 years
That also applies to Android: the mobile operating system is affected. While top-end Android devices, such as the Galaxy S7 and Pixel, receive regular security updates, the vast majority of Android devices sold receive few, if any, post-sale updates.
Google declined to comment, but confirmed that Android is one of the Linux distributions affected. The company has posted a Partner Security Advisory to alert Android partners, one of the steps to those partners then issuing a patch
AFAIK Android M is based on Linux 3.4, but I know usually with supported Linux distros running older kernels that compatibility and security fixes can be backported.
My androids devices are running Android 6 (Marshmallow) - most of these are Motorola and got updated from Android 5 (Lollipop) probably about half a year after it was released - but I also know that many people are still using devices running 4 (KitKat) and older.
So to get a newer version of Android which has this (and other issues) patched, do I have to:
- ...get a new device running Nougat? Apparently updates are supported much better - but only on new devices that come with it (finding reasonably priced ones with Nougat seems difficult in the UK at least)
- ...wait for a OTA update?
- ...try and flash updates myself? I think with non-Nexus devices this is difficult... largely due to drivers?
EDIT: Ok for the first part of the answer I found these saying YES (despite searching before posting...):
- https://security.stackexchange.com/questions/140430/cve-2016-5195-dirty-cow-on-android (links proof of concept and a article)
- https://security.stackexchange.com/questions/140418/what-is-the-possible-impact-of-dirtyc0w-a-k-a-dirty-cow-bug which has answers.
How should I apply updates to older devices?