The security vulnerabilities Meltdown and Spectre are referenced as CVE-2017-5753, CVE-2017-5715 and CVE-2017-5754. Those three variants can be gathered under the more general case CVE-2017-13218 (source).

It is said in the Android security bulletin from January, 2018 that the security patch level 2018-01-05 contains the fix for CVE-2017-13218. According to it, this has been dealt with in the Kernel components, which are binaries. For those, the bulletin says: "The update for that issue is generally contained in the latest binary drivers for Nexus devices available from the Google Developer site". The Kernel is distributed as a binary, and consequently it is not possible to check if the security patch is actually contained in it. On the Google Developer site, the last release available for Pixel Android 7.1.1 (because that's what interests me here) is NOF27D. However this release is already dated from April, 2017. Moreover, the code name of the release (NOF27D) had already been set way before that in platform/build (February, that would be the release 35 of Android 7.1.1).

Hence my question: is the security patch level for Meltdown and Spectre included into the last release of Pixel Android 7.1.1 available currently (NOF27D)?

If yes, does that mean Google has had a patch ready for those issues more than a year ago? If no, where can I find the security patch?

  • As end users, those two vulnerabilities is really something to be safely ignored. – iBug Feb 8 '18 at 9:58
  • 1
    @iBug Why would you ignore a vulnerability that lets any ad read your account login credentials or credit card numbers out of memory? – Dan Hulme Feb 12 '18 at 10:55
  • @DanHulme You certainly underestimated the difficulty to practice this vulnerability. – iBug Feb 12 '18 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.