I need help in understanding Android security patch level. I am running Android 7.1.2 in an IMX.7 board. That is the maximum version supported by my h/w.
From the NVD vulnerability database, running CPE name search against cpe:/:google:android:7.1.2 results in 1214 vulnerabilities, published from 2010 to 2021. The current security patch level of my android is 2017-05-05 which will fix most of vulnerabilities published earlier to 2017. The 2019-10-01 android security bulletin link says it fixes vulnerabilities for 7.1.1, 7.1.2. So is it possible to update my android security patch level to 2019-10-01, so that I can eliminate the vulnerabilities (not all but most) before Oct, 2019.
But I also found from this page, the max security patch level for android-7.1.2_r39(last Nougat release) is 2017-10-01. And I also found the code change for vulnerabilities listed in 2019-10-01 security bulletin are missing in android-7.1.2_r39. So this means 7.1.2 security patch level cannot be updated to 2019-10-01 or Fixes in 2019-10-01 are not implemented in android-7.1.2_r39? I lack understanding on android releases and security patch levels & would like the help from the community.
