Feeds

Android kernel leaks like a colander

359 defects, 88 high risk

Using blade systems to cut costs and sharpen efficiencies

Security analysts at Coverity reckon the Android kernel is riddled with security holes, though they still rate it as twice as good as most open-source projects.

Taking the source code from the HTC Incredible, Coverity found .47 defects per 1,000 lines of code, compared with an industry average of 1 per 1,000. That totalled 359 defects, with 88 of those being high-risk items such as memory corruption, memory leaks and uninitialised variables. Buut Coverity won't be providing any details until the end of the year.

The company discovered the flaws though automated analysis of the source code, and will, in the name of responsible disclosure, provide early access to "the Android security team, OEMs, and security researchers" so they can apply fixes, or create proof-of-concept attacks, before the details go public in 60 days.

Until then, we're left to speculate what proportion of those bugs exist across Android kernel implementations – and how many could be usefully exploited for fun and profit. Manufacturers tweak the Android kernel to suit their hardware. The team only picked the HTC Incredible because they happened to have one handy, but the commonality of chip sets in Android handsets makes it likely the majority of flaws are common too.

Exploiting those flaws is another matter entirely. One can imagine a stack overflow allowing an application to break out of the sandbox security, but such an application would likely be quickly identified and (if distributed via the Marketplace) subsequently removed. It's possible that more-easily-exploited flaws exist too, but hopefully they'll be fixed before Coverity goes public.

Being open to scrutiny is one of the advantages of being open source, so this is no reason to trust your Android handset any less, and if you fancy yourself as a security researcher then drop Coverity a line to get more details. ®

HP ProLiant Gen8: Integrated lifecycle automation

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
Major problems beset UK ISP filth filters: But it's OK, nobody uses them
It's almost as though pr0n was actually rather popular
Microsoft unsheathes cheap Android-killer: Behold, the Lumia 530
Say it with us: I'm King of the Landfill-ill-ill-ill
All those new '5G standards'? Here's the science they rely on
Radio professor tells us how wireless will get faster in the real world
Apple orders huge MOUNTAIN of 80 MILLION 'Air' iPhone 6s
Bigger, harder trouser bulges foretold for fanbois
US freemium mobile network eyes up Europe
FreedomPop touts 'free' calls, texts and data
'Two-speed internet' storm turns FCC.gov into zero-speed website
Deadline for comments on net neutrality shake-up extended to Friday
Oh girl, you jus' didn't: Level 3 slaps Verizon in Netflix throttle blowup
Just hook us up to more 10Gbps ports, backbone biz yells in tit-for-tat spat
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.