Baseband vulnerabilities

wojon

Hello folks,

I just read about some severe baseband vulnerabilities with Exynos. According to this [https://9to5google.com/2023/03/16/google-exynos-modem-vulnerabilities/] Pixel 6 and 7 are affected.

What is the security impact on GrapheneOS and does GrapheneOS have effective features implemented to mitigate those risks?

[deleted]

wojon
https://discuss.grapheneos.org/d/3884-grapheneos-version-2023031500-released

wojon

[deleted] Thanks for pointing to the other thread.

However, I think according to the severity of the issue I believe a separate thread might be a good idea. After all, the linked thread is just a general notification about a new monthly update, but it lacks a proper response of the devs and it contains a lot of speculation.

So, to be more precise: Does GrapheneOS include special measurements to mitigate such a thread. Imagine I am running GrapheneOS on January patch level. Is GrapheneOS affected then from this issue or are there any additional security features in place (e.g. isolating the modem) which make GrapheneOS not affected.

The reasoning behind my question is simple - If ProjectZero takes a look at the Exynos modem and finds 18 security holes, one can safely assume, that there are many more.

GrapheneOS

wojon The cellular model is isolated with or without GrapheneOS. GrapheneOS improves the security of the OS kernel and userspace, which protects it better from being compromised through the cellular modem. You can see that they talk about a compromise of the cellular modem as giving an attacker control of the modem, not the device as a whole, which would usually require further vulnerabilities in the OS. In this case, since some of the vulnerabilities impact 4G rather than only 2G, 3G and 5G you can't avoid them all via our LTE only mode we added for attack surface reduction. They state that many of the vulnerabilities can be avoided by disabling VoWiFi / VoLTE including if your carrier simply doesn't provision those for you, so in this case both 4G and 5G voice are vulnerable to issues not impacting legacy 2G and 3G voice. That's not unusual: newer standards have more complexity and attack surface, which is why we haven't added a 5G only mode yet, but eventually 4G will start being phased out and 4G only will become impractical so the least attack surface will be through 5G only mode to avoid 2G, 3G, 4G and a future 6G standard. It's a moving target, and everything generally becomes much more complex over time. Hopefully firmware moves to using memory safe languages like Rust to avoid the vast majority of these issues.

Kiba

I asked a similar question in the topic of the announcement of the new version of Graphene OS.

That said, I don't think anyone really knows. There will only be speculation until the details are fully known.

Apparently the Pixel 6 are not completely patched unlike the Pixel 7.

I hope baseband isolation is able to protect the integrity of the device, but apparently there is also one of the CVEs that talks about a denial of service and however I don't think baseband isolation would protect this side.

GrapheneOS

Kiba There isn't going to be a difference for the situation with 6th generations Pixels once the official release is available for them, which is expected on Monday. The official release for other devices was March 13th and the official release for 6th generational Pixels will be March 20th. It's currently March 17th so it's only 3 more days until the official release.

We've explicitly documented that there isn't an official AOSP or stock Pixel OS March release for 6th generation Pixels yet. We're using the Android QPR2 Beta 3.2 release for them which does include most of the fixes listed in the Pixel security bulletin 2023-03-05 patch level, but likely has certain missing patches. We know we're providing the full Android 2023-03-05 patch level for them and the Pixel 2023-03-01 patch level, but the Pixel 2023-03-05 patch level including the cellular patches may or may not be provided yet. We've marked them as 2023-03-01 until the official release comes out in case anything in missing.

GrapheneOS

Please look at https://source.android.com/docs/security/bulletin/2023-03-01 and https://source.android.com/docs/security/bulletin/pixel/2023-03-01. As usual, there are many security issues fixed in the latest monthly security patches. You can see that there were 2 serious remote code execution vulnerabilities fixed in AOSP and another 7 fixed in hardware-related code covered by the Pixel security bulletin mostly for the Samsung cellular baseband.

Everything above the Pixel section on the Pixel security bulletin page is a recommended but not mandatory Android Open Source Project patch. You can see that the latest quarterly release of AOSP fixed 69 moderate severity issues not included in the baseline Android Security Bulletin. Most vendors don't ship these recommended patches in the monthly, quarterly and yearly patches until they eventually move to the next yearly release months late, meaning it will be a year until many OEMs and alternate operating systems ship those patches.

For the Pixel section, you can see that most of the issues are really not Pixel specific but rather patches for issues in generic hardware used by Pixels including Snapdragon, Exynos and Samsung's cellular radio. Android Security Bulletins only cover a small subset of these kinds of hardware related issues. Vendors are expected to have their own bulletins covering further hardware related issues impacting their devices.

Kiba

GrapheneOS Thanks for your reply and for the details!

schuubert44

Hi, I've a Pixel 6a with GOS and I'm really happy with it so far - especially compared to Lineage which I used before. But in this case, I've a suggestion for improvement: Wouldn't it be great, to get some kind of notification on the phone by GOS, that there is an unpatched zero day and that the user is recommended to disable VoWiFi / VoLTE until it is fixed. Guess that shouldn't be that hard to implement.

matchboxbananasynergy

schuubert44 The issue with that is that how do you single out specific vulnerabilities in this manner? The fact of life is that there are always things being patched every single month. They are patched as quickly as possible, which is why you should be using devices that receive quick updates and are not EOL. Beyond that, it's the nature of software. There will always be vulnerabilities, and they will be patched.

schuubert44

kwhitewind Really impressive! Maybe we can get GPT-4 to write the security notifications for GOS then ;-)

matchboxbananasynergy Of course this feature could not be "perfect" and warn about every little issue. But it still could be an improvement to the security of GOS, when the users can get informed about critical things like in this case. Maybe just as an option that can be disabled. So the headline linked in first posts says: "Google: Turn off VoLTE, Wi-Fi calling due to severe Exynos modem vulnerabilities on Pixel 6, more". And I guess not every GOS user with a pixel 6 read this article..

kwhitewind

Here is a summary of the thread items created using GPT-4 that I placed in the subreddit to help people get a clear answer without having to dig. I want to thank all those who responded. :)

_Summary:

A thread discusses the security impact of severe baseband vulnerabilities with Exynos on GrapheneOS. Users are concerned about the potential risks to their devices, especially Pixel 6 and 7, and inquire about effective mitigation features in GrapheneOS.

GrapheneOS developers clarify that the cellular modem is isolated with or without GrapheneOS, and the OS improves kernel and userspace security to better protect devices from potential compromise via the cellular modem. GrapheneOS has also implemented an LTE-only mode for attack surface reduction, although it might not completely avoid all vulnerabilities. The developers suggest that avoiding VoWiFi and VoLTE can help mitigate some risks.

Users suggest improvements, such as notifications for unpatched zero-days, but the developers point out that vulnerabilities are an ongoing issue and the best solution is to use devices with quick updates and not EOL (end-of-life)._

androidin

OK, could you please explain for beginners whether the vulnerability is closed or not? I personally own a P7 pro.

Furthermore I can't explicit understand from the previous posts what the setting recommendations are regarding VoLTE, WLAN calls and baseband settings (LTE only) if we have the newest firmware update already on our phone.

Kiba

androidin With the pixel 7, if you have installed the latest security update (March 5, 2023) you are protected and you do not have to block volte or wifi call.

Snowmonk

Kiba may I ask for the same style answer for a 6a?

Kiba

Snowmonk For the case of Pixel 6 and 6a the answer is less clear because all the patches coming from Google will only be published on March 20.

Gos has already applied the available fixes but with the details currently available it is not 100% certain that the problem is fixed.

You can therefore disable VoLTE and VoWifi until the next update and until your Pixel indicates a patch level equal to March 5, 2023.

AtriumCompound

How do you disable voice over LTE? I can't find an option in settings, and entering the carrier settings via ##4636## shows the toggle greyed out

matchboxbananasynergy

AtriumCompound If that is the case, then your carrier doesn't make that option available. It is likely that your carrier has deprecated use of 2G and 3G, which means that for you to be able to make calls, you need to have VoLTE available, as you can't make calls via 4G (LTE) without VoLTE.

You can disable Wi-Fi calling if your carrier makes that available for you, and use airplane mode if you're worried about it.

nilsenils

Has this been fixed in the latest update?

guser39

nilsenils if you're referring to the four CVEs listed in the earlier 9to5Google article, yes.

March 2023 images have been released, including the P6/P6A (March 20th). You can review the security bulletins for specific CVEs.

The 2023032000 release covers the P6/P6A/P6Pro.