"Android 8.0 makes KASLR available in Android kernels 4.4 and newer."
And yet on my pixel with Android 8.0, I am only using 3.18.52. Who actually ships Android with kernel 4.x?
And yet on my pixel with Android 8.0, I am only using 3.18.52. Who actually ships Android with kernel 4.x?
My OnePlus 5 is using kernel 4.4.21 - this is with Nougat 7.1.1, by the way; no Oreo here yet.
Snapdragon 820/821 ships with 3.18. Snapdragon 830 ships with 4.4. Snapdragon 830+1 will ship with 4.9
There's a huge amount of work involved in porting a chipset from one kernel version to another. While I'm sure Google _could_ do it, it's ultimately not worth their while - they'd probably lose support from Qualcomm, and if they hit any weird bugs they'd be on their own.
New android phones from top vendors (not the $50 junk devices) ship with 3.x kernels?
Wow.
You can claim big rewards from Google if you report kernel exploits in Android.
Limiting the scope of vulnerabilities before they are patched.
There's plenty of more recent defence-in-depth work that will make some vulnerabilities impossible to exploit on more recent kernels, and while they will get patched on the older kernels it'd still be nicer if they weren't exploitable in the first place.
But the changes to the normal kernel one as well as some of the changes in data structures are algorithms designed to be more efficient in the first place are probably still useful.
Major and/or userland problems don’t tend to occur as the kernel gets developed and released. There are major advantages in accepting new subsystem code over patched ‘legacy’ code.
They probably wanted to back port it to 3.18 but it was too much work. I'm pretty disappointed they didn't move the Pixel forward to a new kernel though, this seems to be one of the biggest issues with Android.